From 3ddb9cd97d9bb9cbdbcf20e02bbe977b0fd2554d Mon Sep 17 00:00:00 2001 From: Iain Ireland Date: Wed, 3 Apr 2024 17:52:20 +0000 Subject: [PATCH] Bug 1888346: Disable bailout loop detection when frequentBailoutThreshold is too low r=jandem Differential Revision: https://phabricator.services.mozilla.com/D206052 --- js/src/jit-test/tests/cacheir/bug1888346.js | 8 ++++++++ js/src/jit/BaselineBailouts.cpp | 12 +++++++++++- 2 files changed, 19 insertions(+), 1 deletion(-) create mode 100644 js/src/jit-test/tests/cacheir/bug1888346.js diff --git a/js/src/jit-test/tests/cacheir/bug1888346.js b/js/src/jit-test/tests/cacheir/bug1888346.js new file mode 100644 index 000000000000..8e63d8608986 --- /dev/null +++ b/js/src/jit-test/tests/cacheir/bug1888346.js @@ -0,0 +1,8 @@ +setJitCompilerOption("ion.frequent-bailout-threshold", 1); +for (let i = 0; i < 49; i++) { + (function () { + let x = new (function () {})(); + Object.defineProperty(x, "z", {}); + x.z; + })(); +} diff --git a/js/src/jit/BaselineBailouts.cpp b/js/src/jit/BaselineBailouts.cpp index 282cf8c3d384..150e16b618ba 100644 --- a/js/src/jit/BaselineBailouts.cpp +++ b/js/src/jit/BaselineBailouts.cpp @@ -2167,7 +2167,17 @@ bool jit::FinishBailoutToBaseline(BaselineBailoutInfo* bailoutInfoArg) { ionScript->incNumFixableBailouts(); if (ionScript->shouldInvalidate()) { #ifdef DEBUG - if (saveFailedICHash && !JitOptions.disableBailoutLoopCheck) { + // To detect bailout loops, we save a hash of the CacheIR used to + // compile this script, and assert that we don't recompile with the + // exact same inputs. Some of our bailout detection strategies, like + // LICM and stub folding, rely on bailing out, updating some state + // when we hit the baseline fallback, and using that information when + // we invalidate. If the frequentBailoutThreshold is set too low, we + // will instead invalidate the first time we bail out, so we don't + // have the chance to make those decisions. That doesn't happen in + // regular code, so we just skip bailout loop detection in that case. + if (saveFailedICHash && !JitOptions.disableBailoutLoopCheck && + JitOptions.frequentBailoutThreshold > 1) { outerScript->jitScript()->setFailedICHash(ionScript->icHash()); } #endif -- 2.11.4.GIT