Backed out 4 changesets (bug 1132888) for SM-tc(r) failures a=backout

Backed out changeset cd3ff163021b (bug 1132888)
Backed out changeset f596578a143e (bug 1132888)
Backed out changeset 5e2739dedc3a (bug 1132888)
Backed out changeset e4b1a95a7f39 (bug 1132888)

js/src/jit-test/tests/ion/dce-with-rinstructions.js

@@ -3,7 +3,6 @@ setJitCompilerOption("ion.warmup.trigger", 20);
 var i;
 
 var config = getBuildConfiguration();
-var max = 200;
 
 // Check that we are able to remove the operation inside recover test functions (denoted by "rop..."),
 // when we inline the first version of uceFault, and ensure that the bailout is correct
@@ -1292,12 +1291,23 @@ function rhypot_object_4args(i) {
 var uceFault_random = eval(uneval(uceFault).replace('uceFault', 'uceFault_random'));
 function rrandom(i) {
     // setRNGState() exists only in debug builds
-    if(config.debug) setRNGState(2, 1+i);
 
-    var x = Math.random();
-    if (uceFault_random(i) || uceFault_random(i))
-        assertEq(x, config.debug ? setRNGState(2, 1+i) || Math.random() : x);
-    assertRecoveredOnBailout(x, true);
+    if(config.debug) {
+        setRNGState(2, 0);
+        var x = Math.random();
+        if (uceFault_random(i) || uceFault_random(i)) {
+            setRNGState(2, 0);
+            assertEq(x, Math.random());
+        }
+        assertRecoveredOnBailout(x, true);
+    } else {
+        var x = Math.random();
+        if (uceFault_random(i) || uceFault_random(i)) {
+            Math.random();
+        }
+        assertRecoveredOnBailout(x, true);
+    }
+
     return i;
 }
 
@@ -1343,8 +1353,7 @@ function rlog_object(i) {
     return i;
 }
 
-for (j = 100 - max; j < 100; j++) {
-    let i = j < 0 ? Math.abs(j) % 50 : j;
+for (i = 0; i < 100; i++) {
     rbitnot_number(i);
     rbitnot_object(i);
     rbitand_number(i);

js/src/jit-test/tests/ion/recover-objects.js

@@ -4,17 +4,11 @@
 // that Scalar Replacement optimization is working well independently of the
 // object representation.
 
-var max = 200;
-
 // Ion eager fails the test below because we have not yet created any
 // template object in baseline before running the content of the top-level
 // function.
-if (getJitCompilerOptions()["ion.warmup.trigger"] <= max - 10)
-    setJitCompilerOption("ion.warmup.trigger", max - 10);
-
-// Force Inlining heuristics to always inline the functions which have the same
-// number of use count.
-setJitCompilerOption("ion.warmup.trigger", getJitCompilerOptions()["ion.warmup.trigger"]);
+if (getJitCompilerOptions()["ion.warmup.trigger"] <= 90)
+    setJitCompilerOption("ion.warmup.trigger", 90);
 
 // This test checks that we are able to remove the getprop & setprop with scalar
 // replacement, so we should not force inline caches, as this would skip the
@@ -24,7 +18,7 @@ if (getJitCompilerOptions()["ion.forceinlineCaches"])
 
 function resumeHere() {}
 var uceFault = function (i) {
-    if (i > max - 2)
+    if (i > 98)
         uceFault = function (i) { return true; };
     return false;
 };
@@ -90,7 +84,7 @@ function notSoEmpty2(i) {
 
 // Check that we can recover objects with their content.
 var argFault_observeArg = function (i) {
-    if (i > max - 2)
+    if (i > 98)
         return inline_observeArg.arguments[0];
     return { test : i };
 };
@@ -141,9 +135,9 @@ function withinIf(i) {
 // Check case where one successor can have multiple times the same predecessor.
 function unknownLoad(i) {
     var obj = { foo: i };
-    // Unknown properties are inlined as undefined.
     assertEq(obj.bar, undefined);
-    assertRecoveredOnBailout(obj, true);
+    // Unknown properties are using GetPropertyCache.
+    assertRecoveredOnBailout(obj, false);
 }
 
 // Check with dynamic slots.
@@ -160,7 +154,7 @@ function dynamicSlots(i) {
     // beginning of the function.
     resumeHere(); bailout();
     assertEq(obj.p0 + obj.p10 + obj.p20 + obj.p30 + obj.p40, 5 * i + 100);
-    assertRecoveredOnBailout(obj, false);
+    assertRecoveredOnBailout(obj, true);
 }
 
 // Check that we can correctly recover allocations of new objects.
@@ -178,7 +172,7 @@ function createThisWithTemplate(i)
     assertRecoveredOnBailout(p, true);
 }
 
-for (var i = 0; i < max; i++) {
+for (var i = 0; i < 100; i++) {
     notSoEmpty1(i);
     notSoEmpty2(i);
     observeArg(i);

js/src/jit/JitSpewer.cpp

@@ -21,7 +21,6 @@
 #include "jit/Ion.h"
 #include "jit/MIR.h"
 #include "jit/MIRGenerator.h"
-#include "jit/MIRGraph.h"
 
 #include "threading/LockGuard.h"
 
@@ -303,13 +302,6 @@ GraphSpewer::spewPass(const char* pass)
     jsonSpewer_.endPass();
 
     ionspewer.spewPass(this);
-
-    // As this function is used for debugging, we ignore any of the previous
-    // failures and ensure there is enough ballast space, such that we do not
-    // exhaust the ballast space before running the next phase.
-    AutoEnterOOMUnsafeRegion oomUnsafe;
-    if (!graph_->alloc().ensureBallast())
-        oomUnsafe.crash("Could not ensure enough ballast space after spewing graph information.");
 }
 
 void

js/src/jit/MCallOptimize.cpp

@@ -2372,9 +2372,7 @@ IonBuilder::inlineTypedArray(CallInfo& callInfo, Native native)
             return InliningStatus_NotInlined;
 
         callInfo.setImplicitlyUsedUnchecked();
-        MConstant* templateConst = MConstant::NewConstraintlessObject(alloc(), obj);
-        current->add(templateConst);
-        ins = MNewTypedArray::New(alloc(), constraints(), templateConst,
+        ins = MNewTypedArray::New(alloc(), constraints(), obj,
                                   obj->group()->initialHeap(constraints()));
     }
 

js/src/jit/MIR.h

@@ -3365,28 +3365,34 @@ class MNewArrayDynamicLength
     }
 };
 
-class MNewTypedArray
-  : public MUnaryInstruction,
-    public NoTypePolicy::Data
+class MNewTypedArray : public MNullaryInstruction
 {
+    CompilerGCPointer<TypedArrayObject*> templateObject_;
     gc::InitialHeap initialHeap_;
 
-    MNewTypedArray(CompilerConstraintList* constraints, MConstant* templateConst,
+    MNewTypedArray(CompilerConstraintList* constraints, TypedArrayObject* templateObject,
                    gc::InitialHeap initialHeap)
-      : MUnaryInstruction(templateConst),
+      : templateObject_(templateObject),
         initialHeap_(initialHeap)
     {
-        MOZ_ASSERT(!templateObject()->isSingleton());
+        MOZ_ASSERT(!templateObject->isSingleton());
         setResultType(MIRType::Object);
-        setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject()));
+        setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject));
     }
 
   public:
     INSTRUCTION_HEADER(NewTypedArray)
-    TRIVIAL_NEW_WRAPPERS
+
+    static MNewTypedArray* New(TempAllocator& alloc,
+                               CompilerConstraintList* constraints,
+                               TypedArrayObject* templateObject,
+                               gc::InitialHeap initialHeap)
+    {
+        return new(alloc) MNewTypedArray(constraints, templateObject, initialHeap);
+    }
 
     TypedArrayObject* templateObject() const {
-        return &getOperand(0)->toConstant()->toObject().as<TypedArrayObject>();
+        return templateObject_;
     }
 
     gc::InitialHeap initialHeap() const {
@@ -3397,9 +3403,8 @@ class MNewTypedArray
         return AliasSet::None();
     }
 
-    MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override;
-    bool canRecoverOnBailout() const override {
-        return true;
+    bool appendRoots(MRootList& roots) const override {
+        return roots.append(templateObject_);
     }
 };
 

js/src/jit/Recover.cpp

@@ -1301,34 +1301,6 @@ RNewObject::recover(JSContext* cx, SnapshotIterator& iter) const
     return true;
 }
 
-bool
-MNewTypedArray::writeRecoverData(CompactBufferWriter& writer) const
-{
-    MOZ_ASSERT(canRecoverOnBailout());
-    writer.writeUnsigned(uint32_t(RInstruction::Recover_NewTypedArray));
-    return true;
-}
-
-RNewTypedArray::RNewTypedArray(CompactBufferReader& reader)
-{
-}
-
-bool
-RNewTypedArray::recover(JSContext* cx, SnapshotIterator& iter) const
-{
-    RootedObject templateObject(cx, &iter.read().toObject());
-    RootedValue result(cx);
-
-    uint32_t length = templateObject.as<TypedArrayObject>()->length();
-    JSObject* resultObject = TypedArrayCreateWithTemplate(cx, templateObject, length);
-    if (!resultObject)
-        return false;
-
-    result.setObject(*resultObject);
-    iter.storeInstructionResult(result);
-    return true;
-}
-
 bool
 MNewArray::writeRecoverData(CompactBufferWriter& writer) const
 {

js/src/jit/Recover.h

@@ -100,7 +100,6 @@ namespace jit {
     _(ToFloat32)                                \
     _(TruncateToInt32)                          \
     _(NewObject)                                \
-    _(NewTypedArray)                            \
     _(NewArray)                                 \
     _(NewDerivedTypedObject)                    \
     _(CreateThisWithTemplate)                   \
@@ -566,14 +565,6 @@ class RNewObject final : public RInstruction
     MOZ_MUST_USE bool recover(JSContext* cx, SnapshotIterator& iter) const;
 };
 
-class RNewTypedArray final : public RInstruction
-{
-  public:
-    RINSTRUCTION_HEADER_NUM_OP_(NewTypedArray, 1)
-
-    MOZ_MUST_USE bool recover(JSContext* cx, SnapshotIterator& iter) const;
-};
-
 class RNewArray final : public RInstruction
 {
   private:

js/src/jit/ValueNumbering.cpp

@@ -727,8 +727,7 @@ ValueNumberer::visitDefinition(MDefinition* def)
         MResumePoint* rp = nop->resumePoint();
         if (rp && rp->numOperands() > 0 &&
             rp->getOperand(rp->numOperands() - 1) == prev &&
-            !nop->block()->lastIns()->isThrow() &&
-            !prev->isAssertRecoveredOnBailout())
+            !nop->block()->lastIns()->isThrow())
         {
             size_t numOperandsLive = 0;
             for (size_t j = 0; j < prev->numOperands(); j++) {

js/src/jsapi.cpp

@@ -6224,15 +6224,6 @@ JS_SetGlobalJitCompilerOption(JSContext* cx, JSJitCompilerOption opt, uint32_t v
             JitSpew(js::jit::JitSpew_IonScripts, "IonBuilder: Disable non-IC optimizations.");
         }
         break;
-      case JSJITCOMPILER_ION_CHECK_RANGE_ANALYSIS:
-        if (value == 0) {
-            jit::JitOptions.checkRangeAnalysis = false;
-            JitSpew(js::jit::JitSpew_IonScripts, "IonBuilder: Enable range analysis checks.");
-        } else {
-            jit::JitOptions.checkRangeAnalysis = true;
-            JitSpew(js::jit::JitSpew_IonScripts, "IonBuilder: Disable range analysis checks.");
-        }
-        break;
       case JSJITCOMPILER_ION_ENABLE:
         if (value == 1) {
             JS::ContextOptionsRef(cx).setIon(true);
@@ -6304,9 +6295,6 @@ JS_GetGlobalJitCompilerOption(JSContext* cx, JSJitCompilerOption opt, uint32_t*
       case JSJITCOMPILER_ION_FORCE_IC:
         *valueOut = jit::JitOptions.forceInlineCaches;
         break;
-      case JSJITCOMPILER_ION_CHECK_RANGE_ANALYSIS:
-        *valueOut = jit::JitOptions.checkRangeAnalysis;
-        break;
       case JSJITCOMPILER_ION_ENABLE:
         *valueOut = JS::ContextOptionsRef(cx).ion();
         break;

js/src/jsapi.h

@@ -5736,7 +5736,6 @@ JS_SetOffthreadIonCompilationEnabled(JSContext* cx, bool enabled);
     Register(ION_FORCE_IC, "ion.forceinlineCaches")                        \
     Register(ION_ENABLE, "ion.enable")                                     \
     Register(ION_INTERRUPT_WITHOUT_SIGNAL, "ion.interrupt-without-signals") \
-    Register(ION_CHECK_RANGE_ANALYSIS, "ion.check-range-analysis")         \
     Register(BASELINE_ENABLE, "baseline.enable")                           \
     Register(OFFTHREAD_COMPILATION_ENABLE, "offthread-compilation.enable") \
     Register(JUMP_THRESHOLD, "jump-threshold")                             \

js/src/tests/lib/jittests.py

@@ -120,7 +120,6 @@ def __init__(self, path):
         self.test_join = [] # List of other configurations to test with all existing variants.
         self.expect_error = '' # Errors to expect and consider passing
         self.expect_status = 0 # Exit status to expect from shell
-        self.expect_crash = False # Exit status or error output.
         self.is_module = False
         self.test_reflect_stringify = None  # Reflect.stringify implementation to test
 
@@ -142,7 +141,6 @@ def copy(self):
         t.test_join = self.test_join
         t.expect_error = self.expect_error
         t.expect_status = self.expect_status
-        t.expect_crash = self.expect_crash
         t.test_reflect_stringify = self.test_reflect_stringify
         t.enable = True
         t.is_module = self.is_module
@@ -233,8 +231,6 @@ def from_file(cls, path, options):
                         test.test_join.append([name[len('test-join='):]])
                     elif name == 'module':
                         test.is_module = True
-                    elif name == 'crash':
-                        test.expect_crash = True
                     elif name.startswith('--'):
                         # // |jit-test| --ion-gvn=off; --no-sse4
                         test.jitflags.append(name)
@@ -374,19 +370,6 @@ def check_output(out, err, rc, timed_out, test, options):
         if 'Assertion failed:' in line:
             return False
 
-    if test.expect_crash:
-        if sys.platform == 'win32' and rc == 3 - 2 ** 31:
-            return True
-
-        if sys.platform != 'win32' and rc == -11:
-            return True
-
-        # When building with ASan enabled, ASan will convert the -11 returned
-        # value to 1. As a work-around we look for the error output which
-        # includes the crash reason.
-        if rc == 1 and ("Hit MOZ_CRASH" in err or "Assertion failure:" in err):
-            return True
-
     if rc != test.expect_status:
         # Tests which expect a timeout check for exit code 6.
         # Sometimes 0 is returned on Windows for unknown reasons.