960168 - Reified block scopes should prevent magic optimized arguments

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Andy Wingo [:wingo]]

If a function has a JSOP_ARGUMENTS, jsanalyze.cpp will compute an SSA graph for the function in order to see if the arguments object escapes.  However its analysis is not quite right in the presence of block scopes.  Bug 956173 has one error case.

The attached patch makes PUSHBLOCKSCOPE prevent optimization of the arguments object.  This seems to be in spirit with the surrounding GETLOCAL cases.  Note that this does not affect functions that don't reference "arguments"; those for which argumentsHasVarBinding() is false.  (The whole thing is too complicated; see bug 960040.)

Comment 1

[Andy Wingo [:wingo]]

Attachment: Reified block scopes should prevent magic optimized arguments

Comment 2

[Andy Wingo [:wingo]]

Comment on attachment 8360531 [details] [diff] [review]
Reified block scopes should prevent magic optimized arguments

Like I said, not an optimal patch, but everything else seems to punt on "let", so...

Comment 3

[Luke Wagner [:luke]]

Comment on attachment 8360531 [details] [diff] [review]
Reified block scopes should prevent magic optimized arguments

You're right, everything else does.  Having unaliased let variables live in the (nfixed, nslots) tends to complicate things for both jsinfer/jsanalyze/ion, so it gets ignored.  The "obvious" fix, it seems, would be to stick unaliased block-scoped variables in the [0, nfixed) range (reusing slots for disjointly scoped variables).  By any chance is this already in your queue?  ISTR hearing you mention it.

Comment 4

[Andy Wingo [:wingo]]

Tx for the review.  Putting let vars in the nfixed range would make a lot of sense, but it's not currently in my queue.  I think I should get generators baseline jitting first :)

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/45a6f3480c59

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/45a6f3480c59