763233 - IonMonkey: Forbid JITing annotated frames

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Anderson [:dvander] - inactive, e-mail if emergency]

IonMonkey cannot annotate frames, so js_setframeannotation may not work. Current plan is to rename the API to not take an fp, and to only operate on the topmost frame. From there, we can make the API invalidate and forbid ever JITing the calling function.

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Err, this isn't totally good enough since invalidation does not give us an fp. But maybe as part of the bailout we can move the annotation from the entry fp (which could no have had one at entry) to the bailed fp.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: patch for m-i

On try, SetFrameAnnotation's |fp| was always |cx->fp()|, so this should work.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: patch for ionmonkey

This patch disables IonMonkey for annotated frames.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 634198 [details] [diff] [review]
patch for m-i

Review of attachment 634198 [details] [diff] [review]:
-----------------------------------------------------------------

::: caps/src/nsScriptSecurityManager.cpp
@@ +2742,5 @@
>          return NS_ERROR_FAILURE; // XXX better error code?
>      }
>      if (NS_FAILED(principal->EnableCapability(capability, &annotation)))
>          return NS_ERROR_FAILURE;
> +    JS_SetTopFrameAnnotation(cx, annotation);

Is there a way we can assert here or in JS_SetTopFrameAnnotation that fp is the top frame?

::: js/src/jsdbgapi.cpp
@@ +524,2 @@
>  {
> +    cx->fp()->setAnnotation(annotation);

Is it worth asserting that we have a frame?

Comment 5

[Jan de Mooij [:jandem]]

Comment on attachment 634200 [details] [diff] [review]
patch for ionmonkey

Review of attachment 634200 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good, I'm glad this didn't get too complicated.

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

https://hg.mozilla.org/projects/ionmonkey/rev/f6c3f006b57a