834785 - Toplevel script ion compilation fails due to popv opcode if DOM methods/properties used

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Boris Zbarsky [:bzbarsky]]

Attachment: Testcase

A simple testcase is attached.  When I run this in a debug build with IONFLAGS=aborts I get:

[Abort] Unsupported opcode: popv (line 8)
[Abort] aborted @ file:///private/tmp/test.html:8
[Abort] Builder failed to build.
[Abort] IM Compilation failed.
[Abort] Disabling Ion compilation of script file:///private/tmp/test.html:3

Wrapping the loop in a function makes it compile fine.

Comment 1

[Jan de Mooij [:jandem]]

Boris, can we compile global scripts with JSOPTION_NO_SCRIPT_RVAL? That's what the shell uses as well (except for interactive mode of course), and may be the easiest fix...

Comment 2

[Boris Zbarsky [:bzbarsky]]

Hmm.  That's a JSContext option not a CompileOptions option?

I guess we could do that too, actually, but is there a reason it's on the cx?

Comment 3

[Jan de Mooij [:jandem]]

(In reply to Boris Zbarsky (:bz) from comment #2)
> Hmm.  That's a JSContext option not a CompileOptions option?
> 
> I guess we could do that too, actually, but is there a reason it's on the cx?

There is a CompileOptions option too (noScriptRval). Its default value comes from the cx JSOPTION_NO_SCRIPT_RVAL flag, but you can override it using CompileOptions::setNoScriptRval.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Hmm.  So thing is... setting noScriptRval on the options doesn't work because JS::Evaluate happily clobbers it.

So it looks like we need to explicitly pass a null rval to JS::Evaluate here...

Comment 5

[Boris Zbarsky [:bzbarsky]]

This is a regression from bug 824864.  We used to pass in a null vp before then.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Attachment: Make sure to not ask the JS engine for return values in toplevel scripts, so it'll be able to ion-compile them as needed.

Comment 7

[Bobby Holley (:bholley)]

Comment on attachment 707401 [details] [diff] [review]
Make sure to not ask the JS engine for return values in toplevel scripts, so it'll be able to ion-compile them as needed.

Review of attachment 707401 [details] [diff] [review]:
-----------------------------------------------------------------

This patch makes me sad, but I can't think of another way. r=bholley

::: dom/base/nsJSEnvironment.cpp
@@ +1255,4 @@
>    NS_ENSURE_TRUE(mIsInitialized, NS_ERROR_NOT_INITIALIZED);
> +  if (aRetValue) {
> +    *aRetValue = JSVAL_VOID;
> +  }

Can you add a comment here as well explaining why it's necessary to support null here?

Comment 8

[Boris Zbarsky [:bzbarsky]]

Added comment and https://hg.mozilla.org/integration/mozilla-inbound/rev/95b168efcfe8

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/95b168efcfe8