Bug 1147403 part 7 - Fix inIon, only reset the counter when the function is executed. r=jandem

js/src/builtin/TestingFunctions.cpp

@@ -30,6 +30,7 @@
 #include "vm/Interpreter.h"
 #include "vm/ProxyObject.h"
 #include "vm/SavedStacks.h"
+#include "vm/Stack.h"
 #include "vm/TraceLogging.h"
 
 #include "jscntxtinlines.h"
@@ -1545,18 +1546,26 @@ js::testingFunc_inIon(JSContext* cx, unsigned argc, jsval* vp)
         return true;
     }
 
-    JSScript* script = cx->currentScript();
-    if (script && script->getWarmUpResetCount() >= 20) {
-        JSString* error = JS_NewStringCopyZ(cx, "Compilation is being repeatedly prevented. Giving up.");
-        if (!error)
-            return false;
+    ScriptFrameIter iter(cx);
+    if (iter.isIon()) {
+        // Reset the counter of the IonScript's script.
+        JitFrameIterator jitIter(cx);
+        ++jitIter;
+        jitIter.script()->resetWarmUpResetCounter();
+    } else {
+        // Check if we missed multiple attempts at compiling the innermost script.
+        JSScript* script = cx->currentScript();
+        if (script && script->getWarmUpResetCount() >= 20) {
+            JSString* error = JS_NewStringCopyZ(cx, "Compilation is being repeatedly prevented. Giving up.");
+            if (!error)
+                return false;
 
-        args.rval().setString(error);
-        return true;
+            args.rval().setString(error);
+            return true;
+        }
     }
 
-    // false when not in ionMonkey
-    args.rval().setBoolean(false);
+    args.rval().setBoolean(iter.isIon());
     return true;
 }
 

js/src/jit-test/tests/debug/Debugger-onIonCompilation.js

@@ -6,13 +6,6 @@ function test() {
         throw "Skipping test: Ion compilation is disabled/prevented.";
 };
 
-// Skip this test if we cannot reliably compile with Ion.
-try {
-    test();
-} catch (x) {
-    if (typeof x == "string")
-        quit();
-}
 
 // Functions used to assert the representation of the graph which is exported in
 // the JSON string argument.
@@ -65,12 +58,22 @@ g.eval(`
 `);
 
 // Wrap the testing function.
-function check() {
+function check(assert) {
   // print('reset compilation counter.');
   with ({}) {       // Prevent Ion compilation.
     gc();           // Flush previous compilation.
     hits = 0;       // Synchronized hit counts.
-    test();         // Wait until the next Ion compilation.
+
+    try {           // Skip this test if we cannot reliably compile with Ion.
+        test();         // Wait until the next Ion compilation.
+    } catch (msg) {
+        if (typeof msg == "string") {
+            // print(msg);
+            return;
+        }
+    }
+
+    assert();       // Run the assertions given as arguments.
   }
 }
 
@@ -84,9 +87,11 @@ g.eval(`
     parent.hits++;
   };
 `);
-check();
-// '>= 1' is needed because --ion-eager is too eager.
-assertEq(hits >= 1, true);
+
+check(function () {
+    // '>= 1' is needed because --ion-eager is too eager.
+    assertEq(hits >= 1, true);
+});
 
 
 // Try re-entering the same compartment as the compiled script.
@@ -97,8 +102,7 @@ g.dbg.onIonCompilation = function (graph) {
   assertOnIonCompilationArgument(graph);
   hits++;
 };
-check();
-assertEq(hits >= 1, true);
+check(function () { assertEq(hits >= 1, true); });
 
 // Disable the debugger, and redo the last 2 tests.
 g.eval(`
@@ -107,12 +111,11 @@ g.eval(`
     parent.hits++;
   };
 `);
-check();
-assertEq(hits, 0);
+check(function () { assertEq(hits, 0); });
+
 
 g.dbg.enabled = false;
 g.dbg.onIonCompilation = function (graph) {
   hits++;
 };
-check();
-assertEq(hits, 0);
+check(function () { assertEq(hits, 0); });

js/src/jit/IonBuilder.h

@@ -871,7 +871,6 @@ class IonBuilder
     InliningStatus inlineBailout(CallInfo& callInfo);
     InliningStatus inlineAssertFloat32(CallInfo& callInfo);
     InliningStatus inlineAssertRecoveredOnBailout(CallInfo& callInfo);
-    InliningStatus inlineTrue(CallInfo& callInfo);
 
     // Bind function.
     InliningStatus inlineBoundFunction(CallInfo& callInfo, JSFunction* target);

js/src/jit/MCallOptimize.cpp

@@ -263,8 +263,6 @@ IonBuilder::inlineNativeCall(CallInfo& callInfo, JSFunction* target)
         return inlineAssertFloat32(callInfo);
     if (native == testingFunc_assertRecoveredOnBailout)
         return inlineAssertRecoveredOnBailout(callInfo);
-    if (native == testingFunc_inIon || native == testingFunc_inJit)
-        return inlineTrue(callInfo);
 
     // Bound function
     if (native == js::CallOrConstructBoundFunction)
@@ -2672,15 +2670,6 @@ IonBuilder::inlineBailout(CallInfo& callInfo)
     return InliningStatus_Inlined;
 }
 
-IonBuilder::InliningStatus
-IonBuilder::inlineTrue(CallInfo& callInfo)
-{
-    callInfo.setImplicitlyUsedUnchecked();
-
-    pushConstant(BooleanValue(true));
-    return InliningStatus_Inlined;
-}
-
 IonBuilder::InliningStatus
 IonBuilder::inlineAssertFloat32(CallInfo& callInfo)
 {

js/src/jsscript.h

@@ -1373,7 +1373,6 @@ class JSScript : public js::gc::TenuredCell
         if (hasIonScript())
             js::jit::IonScript::writeBarrierPre(zone(), ion);
         ion = ionScript;
-        resetWarmUpResetCounter();
         MOZ_ASSERT_IF(hasIonScript(), hasBaselineScript());
         updateBaselineOrIonRaw(maybecx);
     }