942810 - Ion-compile scripts with aliased let-bound locals

Status: RESOLVED DUPLICATE of bug 1273858

(Core :: JavaScript Engine: JIT, defect)

Description

[Andy Wingo [:wingo]]

Compiling the PUSHBLOCKSCOPE and POPBLOCKSCOPE opcodes would allow block scopes with aliased let-bound variables to ion-compile.

Comment 1

[Andy Wingo [:wingo]]

Attachment: Ion-compile scripts with aliased let-bound locals

Comment 2

[Andy Wingo [:wingo]]

Initial patch; not yet working.  I suspect I am missing a resumeAfter, but for that I would probably need to add some new MIR type, to reflect the ability to set a scope chain inside the function.  The BT I get at runtime, should anyone be interested, is this:

Catchpoint 1 (signal SIGSEGV), 0x0000000000749cfc in js::jit::MResumePoint::setOperand (this=0x7fffdc001878, index=5, operand=0x7fffdc001fd0) at /hack/mozilla-central/js/src/jit/MIR.h:9071
9071	        JS_ASSERT(index < stackDepth_);
(gdb) p stackDepth_
$1 = 5
(gdb) bt
#0  0x0000000000749cfc in js::jit::MResumePoint::setOperand (this=0x7fffdc001878, index=5, operand=0x7fffdc001fd0) at /hack/mozilla-central/js/src/jit/MIR.h:9071
#1  0x0000000000728d0c in js::jit::MBasicBlock::initSlot (this=0x7fffdc0016e0, slot=5, ins=0x7fffdc001fd0) at /hack/mozilla-central/js/src/jit/MIRGraph.cpp:431
#2  0x00000000006cad59 in js::jit::IonBuilder::newOsrPreheader (this=0x1904ec8, predecessor=0x1905818, loopEntry=0x18f90a6 "\343\001\210") at /hack/mozilla-central/js/src/jit/IonBuilder.cpp:5832
#3  0x00000000006bfd5f in js::jit::IonBuilder::forLoop (this=0x1904ec8, op=JSOP_NOP, sn=0x18f90bc "&\026\006!\216\060\211\377\377\373Ј\377\377\371Ո*") at /hack/mozilla-central/js/src/jit/IonBuilder.cpp:2861
#4  0x00000000006bef99 in js::jit::IonBuilder::maybeLoop (this=0x1904ec8, op=JSOP_NOP, sn=0x18f90bc "&\026\006!\216\060\211\377\377\373Ј\377\377\371Ո*") at /hack/mozilla-central/js/src/jit/IonBuilder.cpp:2641
#5  0x00000000006baecf in js::jit::IonBuilder::snoopControlFlow (this=0x1904ec8, op=JSOP_NOP) at /hack/mozilla-central/js/src/jit/IonBuilder.cpp:1342
#6  0x00000000006ba8b1 in js::jit::IonBuilder::traverseBytecode (this=0x1904ec8) at /hack/mozilla-central/js/src/jit/IonBuilder.cpp:1241
#7  0x00000000006b8adf in js::jit::IonBuilder::build (this=0x1904ec8) at /hack/mozilla-central/js/src/jit/IonBuilder.cpp:706
#8  0x000000000094ae5e in js::WorkerThread::handleIonWorkload (this=0x18f2370, state=...) at /hack/mozilla-central/js/src/jsworkers.cpp:768
#9  0x000000000094bbe1 in js::WorkerThread::threadLoop (this=0x18f2370) at /hack/mozilla-central/js/src/jsworkers.cpp:1006
#10 0x000000000094a954 in js::WorkerThread::ThreadMain (arg=0x18f2370) at /hack/mozilla-central/js/src/jsworkers.cpp:694
#11 0x00007ffff75a0161 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so
#12 0x00007ffff7bc6e0e in start_thread (arg=0x7ffff567c700) at pthread_create.c:311
#13 0x00007ffff66820fd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113

That's for this simple loop:

function foo(n) { { for (let x = 0; x < n; x++) if (false) (function() { x }); } }
foo(10000000000)

Comment 3

[Florian Bender]

Andy, I assume you are no longer working on this? Anybody else who can pick this up?

Comment 4

[Andy Wingo [:wingo]]

Nope, I'm not working on this; sorry about that.  It's probably not terribly useful to start from that patch, given the changes over the last year; if someone picks it up I would advise them to start anew :)

Comment 5

[Florian Bender]

Thanks, resetting the assignee.

Comment 6

[Benjamin Bouvier [:bbouvier] (inactive)]

Dupe of bug 1273858 according to comment 0?

Comment 7

[Jan de Mooij [:jandem]]

(In reply to Benjamin Bouvier [:bbouvier] from comment #6)
> Dupe of bug 1273858 according to comment 0?

Yep.