Bug 716647 - Part 5 1/2: Support rematerialized frames in DebugScopes::updateLiveScope. (r=jimb)

js/src/jit-test/tests/debug/Environment-getVariable-13.js

@@ -0,0 +1,47 @@
+// Tests that we can use debug scopes with Ion frames.
+//
+// Unfortunately these tests are brittle. They depend on opaque JIT heuristics
+// kicking in.
+
+load(libdir + "jitopts.js");
+
+if (!jitTogglesMatch(Opts_Ion2NoParallelCompilation))
+  quit(0);
+
+withJitOptions(Opts_Ion2NoParallelCompilation, function () {
+  var g = newGlobal();
+  var dbg = new Debugger;
+
+  // Note that this *depends* on CCW scripted functions being opaque to Ion
+  // optimization and not deoptimizing the frames below the call to toggle.
+  g.toggle = function toggle(d) {
+    if (d) {
+      dbg.addDebuggee(g);
+      var frame = dbg.getNewestFrame();
+      assertEq(frame.implementation, "ion");
+      // g is heavyweight but its call object is optimized out, because its
+      // arguments and locals are unaliased.
+      //
+      // Calling frame.environment here should make a fake debug scope that
+      // gets things directly from the frame. Calling frame.arguments doesn't
+      // go through the scope object and reads directly off the frame. Assert
+      // that the two are equal.
+      assertEq(frame.environment.getVariable("x"), frame.arguments[1]);
+    }
+  };
+
+  g.eval("" + function f(d, x) { g(d, x); });
+  g.eval("" + function g(d, x) {
+    for (var i = 0; i < 200; i++);
+    function inner() { i = 42; };
+    toggle(d);
+    // Use x so it doesn't get optimized out.
+    x++;
+  });
+
+  g.eval("(" + function test() {
+    for (i = 0; i < 5; i++)
+      f(false, 42);
+    f(true, 42);
+  } + ")();");
+});

js/src/jit/RematerializedFrame.cpp

@@ -29,7 +29,8 @@ struct CopyValueToRematerializedFrame
 };
 
 RematerializedFrame::RematerializedFrame(JSContext *cx, uint8_t *top, InlineFrameIterator &iter)
-  : top_(top),
+  : prevUpToDate_(false),
+    top_(top),
     frameNo_(iter.frameNo()),
     numActualArgs_(iter.numActualArgs()),
     script_(iter.script())

js/src/jit/RematerializedFrame.h

@@ -24,6 +24,9 @@ namespace jit {
 //
 class RematerializedFrame
 {
+    // See DebugScopes::updateLiveScopes.
+    bool prevUpToDate_;
+
     // The fp of the top frame associated with this possibly inlined frame.
     uint8_t *top_;
 
@@ -43,6 +46,13 @@ class RematerializedFrame
   public:
     static RematerializedFrame *New(JSContext *cx, uint8_t *top, InlineFrameIterator &iter);
 
+    bool prevUpToDate() const {
+        return prevUpToDate_;
+    }
+    void setPrevUpToDate() {
+        prevUpToDate_ = true;
+    }
+
     uint8_t *top() const {
         return top_;
     }

js/src/vm/ScopeObject.cpp

@@ -2017,11 +2017,7 @@ DebugScopes::updateLiveScopes(JSContext *cx)
      * the flag for us, at exactly the time when execution resumes fp->prev().
      */
     for (AllFramesIter i(cx); !i.done(); ++i) {
-        /*
-         * Debug-mode currently disables Ion compilation in the compartment of
-         * the debuggee.
-         */
-        if (i.isIon())
+        if (!i.hasUsableAbstractFramePtr())
             continue;
 
         AbstractFramePtr frame = i.abstractFramePtr();

js/src/vm/Stack-inl.h

@@ -823,7 +823,9 @@ AbstractFramePtr::prevUpToDate() const
     if (isInterpreterFrame())
         return asInterpreterFrame()->prevUpToDate();
 #ifdef JS_ION
-    return asBaselineFrame()->prevUpToDate();
+    if (isBaselineFrame())
+        return asBaselineFrame()->prevUpToDate();
+    return asRematerializedFrame()->prevUpToDate();
 #else
     MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
@@ -836,7 +838,11 @@ AbstractFramePtr::setPrevUpToDate() const
         return;
     }
 #ifdef JS_ION
-    asBaselineFrame()->setPrevUpToDate();
+    if (isBaselineFrame()) {
+        asBaselineFrame()->setPrevUpToDate();
+        return;
+    }
+    asRematerializedFrame()->setPrevUpToDate();
 #else
     MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif