822385 - Add getters/setters/methods with jitinfo to the shell

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

IonMonkey optimizes calls to DOM getters, setters and methods. Our (shell) fuzzers are currently unable to test any of this though, because the shell does not expose any getters/setters with attached jitinfo.

Adding some getters/setters/methods to the shell shouldn't be hard and will get us a lot of extra fuzz testing for free. Note that we should also add some jit-tests, so that the fuzzers have something to mutate.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Yay!

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Patch

This adds a FakeDOMObject constructor to the shell. It returns an object with a getter, setter and method with attached JitInfo. I verified IonMonkey uses its DOM instructions to access these, and I could reproduce some (browser) problems we found recently in the shell.

I don't have much time to add more stuff, but I think this is a good starting point. We can add additional objects/getters/setters/methods later.

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Patch

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 693296 [details] [diff] [review]
Patch

r=me, sorry for the lag!

Comment 5

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/91dae8287643

Comment 6

[Jan de Mooij [:jandem]]

@decoder, gkw, Jesse: with this patch, "new FakeDOMObject()" in the shell returns an object with properties "x" and "doFoo". Can you guys make sure these are properly fuzzed? I also added a jit-test (tests/basic/test-jitinfo.js) so that the fuzzers that mutate existing tests will test it automatically.

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This got backed out in:

http://hg.mozilla.org/integration/mozilla-inbound/rev/8a7b7f1ac53a

Comment 8

[Jan de Mooij [:jandem]]

(In reply to Gary Kwong [:gkw] from comment #7)
> This got backed out in:
> 
> http://hg.mozilla.org/integration/mozilla-inbound/rev/8a7b7f1ac53a

Nope, the bug number in that commit message is wrong :) Bug 823165 was backed out.

Comment 9

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/91dae8287643