913424 - IonMonkey: Handle JSOP_THIS primitive this case

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

IonBuilder aborts if JSOP_THIS is used and |this| is not guaranteed to be an object. It's pretty easy to trigger and the test in bug 856128 contains a small function that we're not Ion-compiling because of this (no pun intended).

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

Refactors BoxNonStrictThis to return a JSObject * and calls this function from Ion.

Comment 2

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d660739f7498

Linux Try run looks good: https://tbpl.mozilla.org/?tree=Try&rev=7dedb0b3c886

Comment 3

[Gary [:streetwolf52]]

This patch appears to crash SunSpider 1.0.1.  Also Octane results are less.

https://crash-stats.mozilla.com/report/index/b7390028-8388-4440-99b3-90e912130910

Good : http://hg.mozilla.org/integration/mozilla-inbound/rev/a2013b29212c
Bad  : http://hg.mozilla.org/integration/mozilla-inbound/rev/d660739f7498


Mozilla/5.0 (Windows NT 6.3; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0

Comment 4

[Jan de Mooij [:jandem]]

Thanks Gary, I will look into the crash. I don't think this should affect Octane though. Which Octane test is slower for you with this patch?

Comment 5

[Gary [:streetwolf52]]

I was wrong about Octane being slower.

Comment 6

[Jan de Mooij [:jandem]]

Attachment: Fix sunspider crash

This seems to fix the crash. TypeScript::ThisTypes contains the original |this| types before wrapping it, so it's incorrect to use that as the result typeset of ComputeThis.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/d660739f7498

Comment 8

[bomfog]

As of http://hg.mozilla.org/mozilla-central/rev/f73bed2856a8 
(mozilla-central non-PGO hourly, virgin profile) sunspider still crashes for me.

Instead of crashing immediately, it runs through a few iterations (maybe halfway through?) first, so I suppose it could be a different issue.

32 bit windows build on an underpowered win7 laptop.

Comment 9

[Jan de Mooij [:jandem]]

I didn't land the fix yet, here we go:

https://hg.mozilla.org/integration/mozilla-inbound/rev/ab7da1011bf2

Comment 10

[bomfog]

Oops, misunderstood comment 7.

Works fine for me on latest inbound pgo hourly.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/ab7da1011bf2
https://hg.mozilla.org/mozilla-central/rev/211b9c5a464d