792001 - IonMonkey: Fix FromCharCode race condition

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Attachment: Patch

visitFromCharCode stores the char in a static variable and passes its address to a stub. This assumes that JIT code won't run concurrently, but this is false with web workers etc. The patch just passes the code to a stub.

Comment 1

[Nicolas B. Pierron [:nbp] | Offline until 2022-07-04]

Comment on attachment 662125 [details] [diff] [review]
Patch

Review of attachment 662125 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch.

Comment 2

[Tom Schuster [:evilpie]]

Comment on attachment 662125 [details] [diff] [review]
Patch

Review of attachment 662125 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/VMFunctions.cpp
@@ +334,5 @@
> +{
> +    code = uint16_t(code);
> +
> +    if (StaticStrings::hasUnit(code))
> +        return cx->runtime->staticStrings.getUnit(code);

This seems kind of useless considering the inline path in JIT code.

Comment 3

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5a347c0388fd

(In reply to Tom Schuster [:evilpie] from comment #2)
> 
> This seems kind of useless considering the inline path in JIT code.

True, I added it in case we later decide to call the stub in other cases or from somewhere else (and the stub is a slow path anyway so it shouldn't matter for performance).

Comment 4

[Nicolas B. Pierron [:nbp] | Offline until 2022-07-04]

(In reply to Tom Schuster [:evilpie] from comment #2)
> Comment on attachment 662125 [details] [diff] [review]
> Patch
> 
> Review of attachment 662125 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> ::: js/src/ion/VMFunctions.cpp
> @@ +334,5 @@
> > +{
> > +    code = uint16_t(code);
> > +
> > +    if (StaticStrings::hasUnit(code))
> > +        return cx->runtime->staticStrings.getUnit(code);
> 
> This seems kind of useless considering the inline path in JIT code.

I agree, but the function name suppose that it handle all cases, so to avoid disturbing people using it later it's best to keep it like that.  And hasUnit is just a simple branch which is not a perf issue compared to the cost of the out-of-line VM call.

Comment 5

[Jan de Mooij [:jandem]]

I just realized that hasUnit/getUnit take a jschar, so a follow-up patch to pass jschar to them:

https://hg.mozilla.org/integration/mozilla-inbound/rev/a8c051013c48

Comment 6

[Graeme McCutcheon [:graememcc]]

https://hg.mozilla.org/mozilla-central/rev/5a347c0388fd
https://hg.mozilla.org/mozilla-central/rev/a8c051013c48