743394 - IonMonkey: Handle JSOP_EVAL

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Sean Stangl [:sstangl]]

The main function of SS-1.0's date-format-tofte cannot compile due to JSOP_EVAL in a loop.

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

This probably depends on scope work because eval -> heavyweight -> needs call object.

Comment 2

[Sean Stangl [:sstangl]]

date-format-xparb also.

Comment 3

[Brian Hackett [Laid off!]]

This seems to be the main thing slowing down Baseline+Ion vs. JM+Ion right now on SS.  We don't Ion compile the function where tofte spends most of its time, so it always runs in Baseline, which is considerably slower than JM+TI.

The new stuff needed seems to be (a) call a stub for JSOP_EVAL, and (b) create an args object for the frame, which will be required.  It'd be nice if (b) wasn't actually necessary, and the arguments object was just created if the eval() actually tried to access it.

Comment 4

[Brian Hackett [Laid off!]]

Attachment: patch

This (roughly) applies on top of bug 842522.

Comment 5

[Jan de Mooij [:jandem]]

Comment on attachment 715722 [details] [diff] [review]
patch

Review of attachment 715722 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good. r=me with comments below addressed.

::: js/src/vm/Stack-inl.h
@@ +930,5 @@
> +        if (prev->beginsIonActivation()) {
> +            /*
> +             * Walk the stack to find the previous frame's scope chain. Don't
> +             * do this in other cases as this walk does not work when the eval
> +             * comes from an eval-in-frame.

Why does it not work? Eval-in-frame links fp->prev_ to the frame in which we are evaluating the expression, and StackIter just follows prev_. To avoid special handling for eval-in-frame with baseline frames, we should always use StackIter/ScriptFrameIter.

@@ +934,5 @@
> +             * comes from an eval-in-frame.
> +             */
> +            StackIter iter(cx);
> +            while (iter.script() != script())
> +                ++iter;

Use ScriptFrameIter to filter out natives etc (will probably fix eval-in-frame failures too) and if the same script is eval'ed recursively it's safer to do:

/* Ion does not compile eval frames. */
while (iter.isIon() || iter.abstractFramePtr() != *this)
    ++iter;

Comment 6

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0ded3af9b2d7

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/0ded3af9b2d7