820084 - IonMonkey: fix handling of "thisv" value when top-level script is entered into via enterJIT

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Kannan Vijayan [:djvj]]

Ion's enterJIT assumes that the |argv| value it's passed will be negative addressable (at offset -1) to access the |thisv| value for the call.

This is not true for top-level scripts, where |argv| seems to be an independent array of only the arguments, as opposed to a pointer to the third value of a |vp| array, as is usually the case.

enterJIT should be modified to handle this case by explicitly pushing the proper global this-object for when entering ionCode for top-level scripts.

Comment 1

[Kannan Vijayan [:djvj]]

Revision: problem statement above is slightly off.  Top-level scripts never have arguments, so |argv| isn't an issue.  We just need to pass in an appropriate this-included args array and argc=1 to enterJIT when we're calling into a top-level script from the interpreter.

Comment 2

[Kannan Vijayan [:djvj]]

Attachment: Fix

Passes all jit-tests.

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/86236b3e0b1f