Bug 1547721 - Add an Ion script size limit. r=tcampbell

We had a script size limit (and number of locals/args limit) when off-thread Ion
compilation wasn't available, but no hard limit when off-thread compilation is
available. This patch addresses that.

This patch also converts the main-thread limits from constants to JitOptions
because that's what we use for new code.

Differential Revision: https://phabricator.services.mozilla.com/D29217

--HG--
extra : moz-landing-system : lando

js/src/jit/Ion.cpp

@@ -2158,16 +2158,21 @@ static bool ScriptIsTooLarge(JSContext* cx, JSScript* script) {
     return false;
   }
 
-  uint32_t numLocalsAndArgs = NumLocalsAndArgs(script);
+  size_t numLocalsAndArgs = NumLocalsAndArgs(script);
 
-  if (script->length() > MAX_MAIN_THREAD_SCRIPT_SIZE ||
-      numLocalsAndArgs > MAX_MAIN_THREAD_LOCALS_AND_ARGS) {
-    if (!OffThreadCompilationAvailable(cx)) {
-      JitSpew(JitSpew_IonAbort, "Script too large (%zu bytes) (%u locals/args)",
-              script->length(), numLocalsAndArgs);
-      TrackIonAbort(cx, script, script->code(), "too large");
-      return true;
-    }
+  bool canCompileOffThread = OffThreadCompilationAvailable(cx);
+  size_t maxScriptSize = canCompileOffThread
+                             ? JitOptions.ionMaxScriptSize
+                             : JitOptions.ionMaxScriptSizeMainThread;
+  size_t maxLocalsAndArgs = canCompileOffThread
+                                ? JitOptions.ionMaxLocalsAndArgs
+                                : JitOptions.ionMaxLocalsAndArgsMainThread;
+
+  if (script->length() > maxScriptSize || numLocalsAndArgs > maxLocalsAndArgs) {
+    JitSpew(JitSpew_IonAbort, "Script too large (%zu bytes) (%zu locals/args)",
+            script->length(), numLocalsAndArgs);
+    TrackIonAbort(cx, script, script->code(), "too large");
+    return true;
   }
 
   return false;

js/src/jit/IonOptimizationLevels.cpp

@@ -93,14 +93,15 @@ uint32_t OptimizationInfo::compilerWarmUpThreshold(JSScript* script,
   // threshold to improve the compilation's type information and hopefully
   // avoid later recompilation.
 
-  if (script->length() > MAX_MAIN_THREAD_SCRIPT_SIZE) {
-    warmUpThreshold *= (script->length() / double(MAX_MAIN_THREAD_SCRIPT_SIZE));
+  if (script->length() > JitOptions.ionMaxScriptSizeMainThread) {
+    warmUpThreshold *=
+        (script->length() / double(JitOptions.ionMaxScriptSizeMainThread));
   }
 
   uint32_t numLocalsAndArgs = NumLocalsAndArgs(script);
-  if (numLocalsAndArgs > MAX_MAIN_THREAD_LOCALS_AND_ARGS) {
+  if (numLocalsAndArgs > JitOptions.ionMaxLocalsAndArgsMainThread) {
     warmUpThreshold *=
-        (numLocalsAndArgs / double(MAX_MAIN_THREAD_LOCALS_AND_ARGS));
+        (numLocalsAndArgs / double(JitOptions.ionMaxLocalsAndArgsMainThread));
   }
 
   if (!pc || JitOptions.eagerIonCompilation()) {

js/src/jit/JitOptions.cpp

@@ -212,6 +212,14 @@ DefaultJitOptions::DefaultJitOptions() {
   SET_DEFAULT(branchPruningEffectfulInstFactor, 3500);
   SET_DEFAULT(branchPruningThreshold, 4000);
 
+  // Limits on bytecode length and number of locals/arguments for Ion
+  // compilation. There are different (lower) limits for when off-thread Ion
+  // compilation isn't available.
+  SET_DEFAULT(ionMaxScriptSize, 100 * 1000);
+  SET_DEFAULT(ionMaxScriptSizeMainThread, 2 * 1000);
+  SET_DEFAULT(ionMaxLocalsAndArgs, 10 * 1000);
+  SET_DEFAULT(ionMaxLocalsAndArgsMainThread, 256);
+
   // Force the used register allocator instead of letting the optimization
   // pass decide.
   const char* forcedRegisterAllocatorEnv = "JIT_OPTION_forcedRegisterAllocator";

js/src/jit/JitOptions.h

@@ -15,11 +15,6 @@
 namespace js {
 namespace jit {
 
-// Longer scripts can only be compiled off thread, as these compilations
-// can be expensive and stall the main thread for too long.
-static const uint32_t MAX_MAIN_THREAD_SCRIPT_SIZE = 2 * 1000;
-static const uint32_t MAX_MAIN_THREAD_LOCALS_AND_ARGS = 256;
-
 // Possible register allocators which may be used.
 enum IonRegisterAllocator {
   RegisterAllocator_Backtracking,
@@ -98,6 +93,10 @@ struct DefaultJitOptions {
   uint32_t branchPruningBlockSpanFactor;
   uint32_t branchPruningEffectfulInstFactor;
   uint32_t branchPruningThreshold;
+  uint32_t ionMaxScriptSize;
+  uint32_t ionMaxScriptSizeMainThread;
+  uint32_t ionMaxLocalsAndArgs;
+  uint32_t ionMaxLocalsAndArgsMainThread;
   uint32_t wasmBatchIonThreshold;
   uint32_t wasmBatchBaselineThreshold;
   mozilla::Maybe<IonRegisterAllocator> forcedRegisterAllocator;