736315 - IonMonkey: Create JSOP_BAIL and a bail statement for the shell.

Status: RESOLVED DUPLICATE of bug 899735

(Core :: JavaScript Engine, defect)

Description

[Sean Stangl [:sstangl]]

IonMonkey should be able to handle bailing from arbitrary points in the code. Currently it is difficult to test this, since bailout behavior is highly dependent on implementation details that change frequently. There is no good way to cause a bailout that will necessarily remain valid in the future.

For the purpose of writing test cases involving bailout behavior, and for facilitating fuzzing, we should have a dedicated statement to force a bailout.

Comment 1

[Nicolas B. Pierron [:nbp]]

Identically, some tests are relying on the fact that we are switching between different frame types.  and it would be nice to have  JSOP_DONOTCOMPILE (ALL|ION|JM).  If you don't want to lose JSOP slots, you can just use one with an immediate value such as:

JSOP_TESTSUITE [ BAILOUT | DO_NOT_IONIZE | … ]

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

some tricks that are very stable:

|with| prevents compilation in either JIT
|try| prevents compilation in IonMonkey

a bailout can be triggered with: 0()

Comment 3

[Steve Fink [:sfink] [:s:]]

Related: bug 723985 (adding a "use nojit" directive). But it's at whole-script granularity.