Bug 1245860 - Remove Debugger.onIonCompilation Hook. r=shu
authorNicolas B. Pierron <nicolas.b.pierron@mozilla.com>
Mon, 14 Mar 2016 14:41:08 +0000
changeset 288581 193a242cef5449eb7f1bfbbdb8a17c4ea8992152
parent 288580 2b83147ead2695427cd346eb80cf8c33a2210ba7
child 288582 f788142ec96fce20c157d4d270794403074422aa
push id18174
push usercbook@mozilla.com
push dateTue, 15 Mar 2016 09:44:58 +0000
treeherderfx-team@dd0baa33759d [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersshu
bugs1245860
milestone48.0a1
Bug 1245860 - Remove Debugger.onIonCompilation Hook. r=shu
js/src/doc/Debugger/Debugger.md
js/src/doc/Debugger/config.sh
js/src/jit-test/tests/debug/bug1204726.js
js/src/jit-test/tests/ion/bug1199952.js
js/src/jit-test/tests/self-test/findPath-bug1234428.js
js/src/jit/Ion.cpp
js/src/jit/JSONSpewer.cpp
js/src/jit/JSONSpewer.h
js/src/jit/JitSpewer.h
js/src/vm/Debugger-inl.h
js/src/vm/Debugger.cpp
js/src/vm/Debugger.h
--- a/js/src/doc/Debugger/Debugger.md
+++ b/js/src/doc/Debugger/Debugger.md
@@ -249,55 +249,16 @@ compartment.
     API observe activity in only those globals that are reachable by the
     API's user, thus imposing capability-based restrictions on a
     `Debugger`'s reach. However, the `onNewGlobalObject` method allows the
     API user to monitor all global object creation that occurs anywhere
     within the JavaScript system (the "JSRuntime", in SpiderMonkey terms),
     thereby escaping the capability-based limits. For this reason,
     `onNewGlobalObject` is only available to privileged code.
 
-<code>onIonCompilation(<i>graph</i>)</code>
-:   A new IonMonkey compilation result is attached to a script instance of
-    the Debuggee, the <i>graph</i> contains the internal intermediate
-    representations of the compiler.
-
-    The value <i>graph</i> is an object composed of the following properties:
-
-    `json`
-    :   String containing a JSON of the intermediate representation used by
-        the compiler. This JSON string content is composed of 2 intermediate
-        representation of the graph, a `mir` (Middle-level IR), and a
-        `lir` (Low-level IR).
-
-        Both have a property `blocks`, which is an array of basic
-        blocks in [SSA form][ssa-form] which are used to construct the
-        control flow graph. All elements of these arrays are objects which
-        have a `number`, and an `instructions` properties.
-
-        The MIR blocks have additional properties such as the
-        `predecessors` and `successors` of each block, which can
-        be used to reconstruct the control flow graph, with the
-        `number` properties of the blocks.
-
-        The `instructions` properties are array of objects which have
-        an `id` and an `opcode`. The `id` corresponds to the
-        [SSA form][ssa-form] identifier (number) of each instruction, and the
-        `opcode` is a string which represents the instruction.
-
-        This JSON string contains even more detailed internal information
-        which remains undocummented, as it is potentially subject to
-        frequent modifications.
-
-    `scripts`
-    :   Array of [`Debugger.Script`][script] instances. For a block at
-        `mir.blocks[i]` or `lir.blocks[i]` in the JSON, `scripts[i]` is the
-        [`Debugger.Script`][script] containing that block's code.
-
-    This method's return value is ignored.
-
 
 
 ## Function Properties of the Debugger Prototype Object
 
 The functions described below may only be called with a `this` value
 referring to a `Debugger` instance; they may not be used as methods of
 other kinds of objects.
 
--- a/js/src/doc/Debugger/config.sh
+++ b/js/src/doc/Debugger/config.sh
@@ -59,10 +59,9 @@ resource 'img-chrome-pref'        enable
 resource 'img-scratchpad-browser' scratchpad-browser-environment.png $RBASE/7229/scratchpad-browser-environment.png
 resource 'img-example-alert'      debugger-alert.png                 $RBASE/7231/debugger-alert.png
 resource 'img-alloc-plot'         alloc-plot-console.png             $RBASE/8461/alloc-plot-console.png
 
 # External links:
 absolute-label 'protocol' https://wiki.mozilla.org/Remote_Debugging_Protocol "Remote Debugging Protocol"
 absolute-label 'saved-frame' https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey/SavedFrame "SavedFrame"
 absolute-label 'bernoulli-trial' https://en.wikipedia.org/wiki/Bernoulli_trial "Bernoulli Trial"
-absolute-label 'ssa-form' https://en.wikipedia.org/wiki/Static_single_assignment_form "SSA form"
 absolute-label 'promise-debugging' https://mxr.mozilla.org/mozilla-central/source/dom/webidl/PromiseDebugging.webidl?rev=331d71cabe1e "PromiseDebugging.webidl"
deleted file mode 100644
--- a/js/src/jit-test/tests/debug/bug1204726.js
+++ /dev/null
@@ -1,14 +0,0 @@
-
-setJitCompilerOption("ion.warmup.trigger", 1);
-gczeal(4);
-function test() {
-  for (var res = false; !res; res = inIon()) {};
-}
-var g = newGlobal();
-g.parent = this;
-g.eval(`
-  var dbg = new Debugger();
-  var parentw = dbg.addDebuggee(parent);
-  dbg.onIonCompilation = function (graph) {};
-`);
-test();
deleted file mode 100644
--- a/js/src/jit-test/tests/ion/bug1199952.js
+++ /dev/null
@@ -1,23 +0,0 @@
-var g = newGlobal();
-g.parent = this;
-g.eval(`
-    var dbg = new Debugger();
-    var parentw = dbg.addDebuggee(parent);
-    dbg.onIonCompilation = function (graph) {};
-`);
-gczeal(7,1);
-var findNearestDateBefore = function(start, predicate) {
-    var current = start;
-    var month = 1000 * 60 * 60 * 24 * 30;
-    for (var step = month; step > 0; step = Math.floor(step / 3)) {
-        !predicate(current);
-        current = new Date(current.getTime() + step);
-    }
-};
-var juneDate = new Date(2000, 5, 20, 0, 0, 0, 0);
-var decemberDate = new Date(2000, 11, 20, 0, 0, 0, 0);
-var juneOffset = juneDate.getTimezoneOffset();
-var decemberOffset = decemberDate.getTimezoneOffset();
-var isSouthernHemisphere = (juneOffset > decemberOffset);
-var winterTime = isSouthernHemisphere ? juneDate : decemberDate;
-var dstStart = findNearestDateBefore(winterTime, function (date) {});
deleted file mode 100644
--- a/js/src/jit-test/tests/self-test/findPath-bug1234428.js
+++ /dev/null
@@ -1,23 +0,0 @@
-// 1. --ion-eager causes all functions to be compiled with IonMonkey before
-//    executing them.
-// 2. Registering the onIonCompilation hook on the Debugger causes
-//    the JSScript of the function C to be wrapped in the Debugger compartment.
-// 3. The JSScript hold a pointer to its function C.
-// 4. The function C, hold its environment.
-// 5. The environment holds the Object o.
-g = newGlobal();
-g.parent = this;
-g.eval(`
-  dbg = Debugger(parent);
-  dbg.onIonCompilation = function () {};
-`);
-
-function foo() {
-  eval(`
-    var o = {};
-    function C() {};
-    new C;
-    findPath(o, o);
-  `);
-}
-foo();
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -49,16 +49,17 @@
 #include "jscompartmentinlines.h"
 #include "jsobjinlines.h"
 #include "jsscriptinlines.h"
 
 #include "jit/JitFrames-inl.h"
 #include "jit/shared/Lowering-shared-inl.h"
 #include "vm/Debugger-inl.h"
 #include "vm/ScopeObject-inl.h"
+#include "vm/Stack-inl.h"
 
 using namespace js;
 using namespace js::jit;
 
 // Assert that JitCode is gc::Cell aligned.
 JS_STATIC_ASSERT(sizeof(JitCode) % gc::CellSize == 0);
 
 static MOZ_THREAD_LOCAL(JitContext*) TlsJitContext;
@@ -432,80 +433,16 @@ JitCompartment::ensureIonStubsExist(JSCo
         stringConcatStub_ = generateStringConcatStub(cx);
         if (!stringConcatStub_)
             return false;
     }
 
     return true;
 }
 
-struct OnIonCompilationInfo {
-    size_t numBlocks;
-    size_t scriptIndex;
-    LifoAlloc alloc;
-    LSprinter graph;
-
-    OnIonCompilationInfo()
-      : numBlocks(0),
-        scriptIndex(0),
-        alloc(4096),
-        graph(&alloc)
-    { }
-
-    bool filled() const {
-        return numBlocks != 0;
-    }
-};
-
-typedef Vector<OnIonCompilationInfo> OnIonCompilationVector;
-
-// This function initializes the values which are given to the Debugger
-// onIonCompilation hook, if the compilation was successful, and if Ion
-// compilations of this compartment are watched by any debugger.
-//
-// This function must be called in the same AutoEnterAnalysis section as the
-// CodeGenerator::link. Failing to do so might leave room to interleave other
-// allocations which can invalidate any JSObject / JSFunction referenced by the
-// MIRGraph.
-//
-// This function ignores any allocation failure and returns whether the
-// Debugger::onIonCompilation should be called.
-static inline void
-PrepareForDebuggerOnIonCompilationHook(JSContext* cx, jit::MIRGraph& graph,
-                                       MutableHandle<ScriptVector> scripts,
-                                       OnIonCompilationInfo* info)
-{
-    info->numBlocks = 0;
-    if (!Debugger::observesIonCompilation(cx))
-        return;
-
-    // fireOnIonCompilation failures are ignored, do the same here.
-    info->scriptIndex = scripts.length();
-    if (!scripts.reserve(graph.numBlocks() + scripts.length())) {
-        cx->clearPendingException();
-        return;
-    }
-
-    // Collect the list of scripts which are inlined in the MIRGraph.
-    info->numBlocks = graph.numBlocks();
-    for (jit::MBasicBlockIterator block(graph.begin()); block != graph.end(); block++)
-        scripts.infallibleAppend(block->info().script());
-
-    // Spew the JSON graph made for the Debugger at the end of the LifoAlloc
-    // used by the compiler. This would not prevent unexpected GC from the
-    // compartment of the Debuggee, but do them as part of the compartment of
-    // the Debugger when the content is copied over to a JSString.
-    jit::JSONSpewer spewer(info->graph);
-    spewer.spewDebuggerGraph(&graph);
-    if (info->graph.hadOutOfMemory()) {
-        scripts.resize(info->scriptIndex);
-        info->numBlocks = 0;
-    }
-}
-
 void
 jit::FinishOffThreadBuilder(JSContext* cx, IonBuilder* builder)
 {
     MOZ_ASSERT(HelperThreadState().isLocked());
 
     // Clean the references to the pending IonBuilder, if we just finished it.
     if (builder->script()->baselineScript()->hasPendingIonBuilder() &&
         builder->script()->baselineScript()->pendingIonBuilder() == builder)
@@ -548,48 +485,45 @@ FinishAllOffThreadCompilations(JSCompart
         if (builder->compartment == CompileCompartment::get(comp)) {
             FinishOffThreadBuilder(nullptr, builder);
             HelperThreadState().remove(finished, &i);
         }
     }
 }
 
 static bool
-LinkCodeGen(JSContext* cx, IonBuilder* builder, CodeGenerator *codegen,
-            MutableHandle<ScriptVector> scripts, OnIonCompilationInfo* info)
+LinkCodeGen(JSContext* cx, IonBuilder* builder, CodeGenerator *codegen)
 {
     RootedScript script(cx, builder->script());
     TraceLoggerThread* logger = TraceLoggerForMainThread(cx->runtime());
     TraceLoggerEvent event(logger, TraceLogger_AnnotateScripts, script);
     AutoTraceLog logScript(logger, event);
     AutoTraceLog logLink(logger, TraceLogger_IonLinking);
 
     if (!codegen->link(cx, builder->constraints()))
         return false;
 
-    PrepareForDebuggerOnIonCompilationHook(cx, builder->graph(), scripts, info);
     return true;
 }
 
 static bool
-LinkBackgroundCodeGen(JSContext* cx, IonBuilder* builder,
-                      MutableHandle<ScriptVector> scripts, OnIonCompilationInfo* info)
+LinkBackgroundCodeGen(JSContext* cx, IonBuilder* builder)
 {
     CodeGenerator* codegen = builder->backgroundCodegen();
     if (!codegen)
         return false;
 
     JitContext jctx(cx, &builder->alloc());
 
     // Root the assembler until the builder is finished below. As it was
     // constructed off thread, the assembler has not been rooted previously,
     // though any GC activity would discard the builder.
     MacroAssembler::AutoRooter masm(cx, &codegen->masm);
 
-    return LinkCodeGen(cx, builder, codegen, scripts, info);
+    return LinkCodeGen(cx, builder, codegen);
 }
 
 void
 jit::LazyLink(JSContext* cx, HandleScript calleeScript)
 {
     IonBuilder* builder;
 
     {
@@ -599,40 +533,33 @@ jit::LazyLink(JSContext* cx, HandleScrip
         MOZ_ASSERT(calleeScript->hasBaselineScript());
         builder = calleeScript->baselineScript()->pendingIonBuilder();
         calleeScript->baselineScript()->removePendingIonBuilder(calleeScript);
 
         // Remove from pending.
         builder->removeFrom(HelperThreadState().ionLazyLinkList());
     }
 
-    // See PrepareForDebuggerOnIonCompilationHook
-    Rooted<ScriptVector> debugScripts(cx, ScriptVector(cx));
-    OnIonCompilationInfo info;
-
     {
         AutoEnterAnalysis enterTypes(cx);
-        if (!LinkBackgroundCodeGen(cx, builder, &debugScripts, &info)) {
+        if (!LinkBackgroundCodeGen(cx, builder)) {
             // Silently ignore OOM during code generation. The assembly code
             // doesn't has code to handle it after linking happened. So it's
             // not OK to throw a catchable exception from there.
             cx->clearPendingException();
 
             // Reset the TypeZone's compiler output for this script, if any.
             InvalidateCompilerOutputsForScript(cx, calleeScript);
         }
     }
 
     {
         AutoLockHelperThreadState lock;
         FinishOffThreadBuilder(cx, builder);
     }
-
-    if (info.filled())
-        Debugger::onIonCompilation(cx, debugScripts, info.graph);
 }
 
 uint8_t*
 jit::LazyLinkTopActivation(JSContext* cx)
 {
     // First frame should be an exit frame.
     JitFrameIterator it(cx);
     LazyLinkExitFrameLayout* ll = it.exitFrame()->as<LazyLinkExitFrameLayout>();
@@ -2248,37 +2175,30 @@ IonCompile(JSContext* cx, JSScript* scri
 
         // The allocator and associated data will be destroyed after being
         // processed in the finishedOffThreadCompilations list.
         autoDelete.forget();
 
         return AbortReason_NoAbort;
     }
 
-    // See PrepareForDebuggerOnIonCompilationHook
-    Rooted<ScriptVector> debugScripts(cx, ScriptVector(cx));
-    OnIonCompilationInfo debugInfo;
-
     {
         ScopedJSDeletePtr<CodeGenerator> codegen;
         AutoEnterAnalysis enter(cx);
         codegen = CompileBackEnd(builder);
         if (!codegen) {
             JitSpew(JitSpew_IonAbort, "Failed during back-end compilation.");
             if (cx->isExceptionPending())
                 return AbortReason_Error;
             return AbortReason_Disable;
         }
 
-        succeeded = LinkCodeGen(cx, builder, codegen, &debugScripts, &debugInfo);
+        succeeded = LinkCodeGen(cx, builder, codegen);
     }
 
-    if (debugInfo.filled())
-        Debugger::onIonCompilation(cx, debugScripts, debugInfo.graph);
-
     if (succeeded)
         return AbortReason_NoAbort;
     if (cx->isExceptionPending())
         return AbortReason_Error;
     return AbortReason_Disable;
 }
 
 static bool
--- a/js/src/jit/JSONSpewer.cpp
+++ b/js/src/jit/JSONSpewer.cpp
@@ -1,14 +1,16 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#ifdef JS_JITSPEW
+
 #include "jit/JSONSpewer.h"
 
 #include <stdarg.h>
 
 #include "jit/BacktrackingAllocator.h"
 #include "jit/LIR.h"
 #include "jit/MIR.h"
 #include "jit/MIRGraph.h"
@@ -398,16 +400,9 @@ JSONSpewer::endPass()
 
 void
 JSONSpewer::endFunction()
 {
     endList();
     endObject();
 }
 
-void
-JSONSpewer::spewDebuggerGraph(MIRGraph* graph)
-{
-    beginObject();
-    spewMIR(graph);
-    spewLIR(graph);
-    endObject();
-}
+#endif /* JS_JITSPEW */
--- a/js/src/jit/JSONSpewer.h
+++ b/js/src/jit/JSONSpewer.h
@@ -2,16 +2,18 @@
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef jit_JSONSpewer_h
 #define jit_JSONSpewer_h
 
+#ifdef JS_JITSPEW
+
 #include <stdio.h>
 
 #include "js/TypeDecls.h"
 #include "vm/Printer.h"
 
 namespace js {
 namespace jit {
 
@@ -55,16 +57,16 @@ class JSONSpewer
     void spewMDef(MDefinition* def);
     void spewMResumePoint(MResumePoint* rp);
     void spewMIR(MIRGraph* mir);
     void spewLIns(LNode* ins);
     void spewLIR(MIRGraph* mir);
     void spewRanges(BacktrackingAllocator* regalloc);
     void endPass();
     void endFunction();
-
-    void spewDebuggerGraph(MIRGraph* mir);
 };
 
 } // namespace jit
 } // namespace js
 
+#endif /* JS_JITSPEW */
+
 #endif /* jit_JSONSpewer_h */
--- a/js/src/jit/JitSpewer.h
+++ b/js/src/jit/JitSpewer.h
@@ -9,18 +9,21 @@
 
 #include "mozilla/DebugOnly.h"
 #include "mozilla/IntegerPrintfMacros.h"
 
 #include <stdarg.h>
 
 #include "jit/C1Spewer.h"
 #include "jit/JSONSpewer.h"
+
 #include "js/RootingAPI.h"
 
+#include "vm/Printer.h"
+
 namespace js {
 namespace jit {
 
 // New channels may be added below.
 #define JITSPEW_CHANNEL_LIST(_)             \
     /* Information during sinking */        \
     _(Prune)                                \
     /* Information during escape analysis */\
@@ -96,17 +99,20 @@ namespace jit {
 
 enum JitSpewChannel {
 #define JITSPEW_CHANNEL(name) JitSpew_##name,
     JITSPEW_CHANNEL_LIST(JITSPEW_CHANNEL)
 #undef JITSPEW_CHANNEL
     JitSpew_Terminator
 };
 
+class BacktrackingAllocator;
+class MDefinition;
 class MIRGenerator;
+class MIRGraph;
 class TempAllocator;
 
 // The JitSpewer is only available on debug builds.
 // None of the global functions have effect on non-debug builds.
 static const int NULL_ID = -1;
 
 #ifdef JS_JITSPEW
 
--- a/js/src/vm/Debugger-inl.h
+++ b/js/src/vm/Debugger-inl.h
@@ -61,39 +61,16 @@ js::Debugger::onDebuggerStatement(JSCont
 /* static */ JSTrapStatus
 js::Debugger::onExceptionUnwind(JSContext* cx, AbstractFramePtr frame)
 {
     if (!cx->compartment()->isDebuggee())
         return JSTRAP_CONTINUE;
     return slowPathOnExceptionUnwind(cx, frame);
 }
 
-/* static */ bool
-js::Debugger::observesIonCompilation(JSContext* cx)
-{
-    // If the current compartment is observed by any Debugger.
-    if (!cx->compartment()->isDebuggee())
-        return false;
-
-    // If any attached Debugger watch for Jit compilation results.
-    if (!Debugger::hasLiveHook(cx->global(), Debugger::OnIonCompilation))
-        return false;
-
-    return true;
-}
-
-/* static */ void
-js::Debugger::onIonCompilation(JSContext* cx, Handle<ScriptVector> scripts, LSprinter& graph)
-{
-    if (!observesIonCompilation(cx))
-        return;
-
-    slowPathOnIonCompilation(cx, scripts, graph);
-}
-
 /* static */ void
 js::Debugger::onNewWasmModule(JSContext* cx, Handle<WasmModuleObject*> wasmModule)
 {
     // Insert the wasm::Module into a compartment-wide list for discovery
     // later without a heap walk.
     cx->compartment()->wasmModuleWeakList.insertBack(&wasmModule->module());
     if (cx->compartment()->isDebuggee())
         slowPathOnNewWasmModule(cx, wasmModule);
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -20,18 +20,16 @@
 #include "jswrapper.h"
 
 #include "frontend/BytecodeCompiler.h"
 #include "frontend/Parser.h"
 #include "gc/Marking.h"
 #include "gc/Policy.h"
 #include "jit/BaselineDebugModeOSR.h"
 #include "jit/BaselineJIT.h"
-#include "jit/JSONSpewer.h"
-#include "jit/MIRGraph.h"
 #include "js/GCAPI.h"
 #include "js/UbiNodeBreadthFirst.h"
 #include "js/Vector.h"
 #include "vm/ArgumentsObject.h"
 #include "vm/DebuggerMemory.h"
 #include "vm/SPSProfiler.h"
 #include "vm/TraceLogging.h"
 #include "vm/WrapperObject.h"
@@ -1553,85 +1551,16 @@ Debugger::fireOnGarbageCollectionHook(JS
     }
 
     RootedValue dataVal(cx, ObjectValue(*dataObj));
     RootedValue rv(cx);
     if (!Invoke(cx, ObjectValue(*object), ObjectValue(*hook), 1, dataVal.address(), &rv))
         handleUncaughtException(ac, true);
 }
 
-JSTrapStatus
-Debugger::fireOnIonCompilationHook(JSContext* cx, Handle<ScriptVector> scripts, LSprinter& graph)
-{
-    RootedObject hook(cx, getHook(OnIonCompilation));
-    MOZ_ASSERT(hook);
-    MOZ_ASSERT(hook->isCallable());
-
-    Maybe<AutoCompartment> ac;
-    ac.emplace(cx, object);
-
-    // Copy the vector of scripts to a JS Array of Debugger.Script
-    RootedObject tmpObj(cx);
-    RootedValue tmpVal(cx);
-    AutoValueVector dbgScripts(cx);
-    for (size_t i = 0; i < scripts.length(); i++) {
-        tmpObj = wrapScript(cx, scripts[i]);
-        if (!tmpObj)
-            return handleUncaughtException(ac, false);
-
-        tmpVal.setObject(*tmpObj);
-        if (!dbgScripts.append(tmpVal))
-            return handleUncaughtException(ac, false);
-    }
-
-    RootedObject dbgScriptsArray(cx, JS_NewArrayObject(cx, dbgScripts));
-    if (!dbgScriptsArray)
-        return handleUncaughtException(ac, false);
-
-    // Copy the JSON compilation graph to a JS String which is allocated as part
-    // of the Debugger compartment.
-    Sprinter jsonPrinter(cx);
-    if (!jsonPrinter.init())
-        return handleUncaughtException(ac, false);
-
-    graph.exportInto(jsonPrinter);
-    if (jsonPrinter.hadOutOfMemory())
-        return handleUncaughtException(ac, false);
-
-    RootedString json(cx, JS_NewStringCopyZ(cx, jsonPrinter.string()));
-    if (!json)
-        return handleUncaughtException(ac, false);
-
-    // Create a JS Object which has the array of scripts, and the string of the
-    // JSON graph.
-    const char* names[] = { "scripts", "json" };
-    JS::AutoValueArray<2> values(cx);
-    values[0].setObject(*dbgScriptsArray);
-    values[1].setString(json);
-
-    RootedObject obj(cx, JS_NewObject(cx, nullptr));
-    if (!obj)
-        return handleUncaughtException(ac, false);
-
-    MOZ_ASSERT(mozilla::ArrayLength(names) == values.length());
-    for (size_t i = 0; i < mozilla::ArrayLength(names); i++) {
-        if (!JS_DefineProperty(cx, obj, names[i], values[i], JSPROP_ENUMERATE, nullptr, nullptr))
-            return handleUncaughtException(ac, false);
-    }
-
-    // Call Debugger.onIonCompilation hook.
-    JS::AutoValueArray<1> argv(cx);
-    argv[0].setObject(*obj);
-
-    RootedValue rv(cx);
-    if (!Invoke(cx, ObjectValue(*object), ObjectValue(*hook), 1, argv.begin(), &rv))
-        return handleUncaughtException(ac, true);
-    return JSTRAP_CONTINUE;
-}
-
 template <typename HookIsEnabledFun /* bool (Debugger*) */,
           typename FireHookFun /* JSTrapStatus (Debugger*) */>
 /* static */ JSTrapStatus
 Debugger::dispatchHook(JSContext* cx, HookIsEnabledFun hookIsEnabled, FireHookFun fireHook)
 {
     /*
      * Determine which debuggers will receive this event, and in what order.
      * Make a copy of the list, since the original is mutable and we will be
@@ -1992,35 +1921,16 @@ Debugger::slowPathOnLogAllocationSite(JS
         {
             return false;
         }
     }
 
     return true;
 }
 
-/* static */ void
-Debugger::slowPathOnIonCompilation(JSContext* cx, Handle<ScriptVector> scripts, LSprinter& graph)
-{
-    JSTrapStatus status = dispatchHook(
-        cx,
-        [](Debugger* dbg) -> bool { return dbg->getHook(OnIonCompilation); },
-        [&](Debugger* dbg) -> JSTrapStatus {
-            (void) dbg->fireOnIonCompilationHook(cx, scripts, graph);
-            return JSTRAP_CONTINUE;
-        });
-
-    if (status == JSTRAP_ERROR) {
-        cx->clearPendingException();
-        return;
-    }
-
-    MOZ_ASSERT(status == JSTRAP_CONTINUE);
-}
-
 bool
 Debugger::isDebuggeeUnbarriered(const JSCompartment* compartment) const
 {
     MOZ_ASSERT(compartment);
     return compartment->isDebuggee() && debuggees.has(compartment->unsafeUnbarrieredMaybeGlobal());
 }
 
 bool
@@ -3314,30 +3224,16 @@ Debugger::getMemory(JSContext* cx, unsig
             return false;
         memoryValue = ObjectValue(*memory);
     }
 
     args.rval().set(memoryValue);
     return true;
 }
 
-/* static */ bool
-Debugger::getOnIonCompilation(JSContext* cx, unsigned argc, Value* vp)
-{
-    THIS_DEBUGGER(cx, argc, vp, "(get onIonCompilation)", args, dbg);
-    return getHookImpl(cx, args, *dbg, OnIonCompilation);
-}
-
-/* static */ bool
-Debugger::setOnIonCompilation(JSContext* cx, unsigned argc, Value* vp)
-{
-    THIS_DEBUGGER(cx, argc, vp, "(set onIonCompilation)", args, dbg);
-    return setHookImpl(cx, args, *dbg, OnIonCompilation);
-}
-
 /*
  * Given a value used to designate a global (there's quite a variety; see the
  * docs), return the actual designee.
  *
  * Note that this does not check whether the designee is marked "invisible to
  * Debugger" or not; different callers need to handle invisible-to-Debugger
  * globals in different ways.
  */
@@ -4954,17 +4850,16 @@ const JSPropertySpec Debugger::propertie
     JS_PSGS("onNewGlobalObject", Debugger::getOnNewGlobalObject, Debugger::setOnNewGlobalObject, 0),
     JS_PSGS("uncaughtExceptionHook", Debugger::getUncaughtExceptionHook,
             Debugger::setUncaughtExceptionHook, 0),
     JS_PSGS("allowUnobservedAsmJS", Debugger::getAllowUnobservedAsmJS,
             Debugger::setAllowUnobservedAsmJS, 0),
     JS_PSGS("collectCoverageInfo", Debugger::getCollectCoverageInfo,
             Debugger::setCollectCoverageInfo, 0),
     JS_PSG("memory", Debugger::getMemory, 0),
-    JS_PSGS("onIonCompilation", Debugger::getOnIonCompilation, Debugger::setOnIonCompilation, 0),
     JS_PS_END
 };
 const JSFunctionSpec Debugger::methods[] = {
     JS_FN("addDebuggee", Debugger::addDebuggee, 1, 0),
     JS_FN("addAllGlobalsAsDebuggees", Debugger::addAllGlobalsAsDebuggees, 0, 0),
     JS_FN("removeDebuggee", Debugger::removeDebuggee, 1, 0),
     JS_FN("removeAllDebuggees", Debugger::removeAllDebuggees, 0, 0),
     JS_FN("hasDebuggee", Debugger::hasDebuggee, 1, 0),
--- a/js/src/vm/Debugger.h
+++ b/js/src/vm/Debugger.h
@@ -32,18 +32,16 @@ enum JSTrapStatus {
     JSTRAP_CONTINUE,
     JSTRAP_RETURN,
     JSTRAP_THROW,
     JSTRAP_LIMIT
 };
 
 namespace js {
 
-class LSprinter;
-
 class Breakpoint;
 class DebuggerMemory;
 
 typedef HashSet<ReadBarrieredGlobalObject,
                 MovableCellHasher<ReadBarrieredGlobalObject>,
                 RuntimeAllocPolicy> WeakGlobalObjectSet;
 
 /*
@@ -253,17 +251,16 @@ class Debugger : private mozilla::Linked
         OnDebuggerStatement,
         OnExceptionUnwind,
         OnNewScript,
         OnEnterFrame,
         OnNewGlobalObject,
         OnNewPromise,
         OnPromiseSettled,
         OnGarbageCollection,
-        OnIonCompilation,
         HookCount
     };
     enum {
         JSSLOT_DEBUG_PROTO_START,
         JSSLOT_DEBUG_FRAME_PROTO = JSSLOT_DEBUG_PROTO_START,
         JSSLOT_DEBUG_ENV_PROTO,
         JSSLOT_DEBUG_OBJECT_PROTO,
         JSSLOT_DEBUG_SCRIPT_PROTO,
@@ -583,18 +580,16 @@ class Debugger : private mozilla::Linked
     static bool setOnPromiseSettled(JSContext* cx, unsigned argc, Value* vp);
     static bool getUncaughtExceptionHook(JSContext* cx, unsigned argc, Value* vp);
     static bool setUncaughtExceptionHook(JSContext* cx, unsigned argc, Value* vp);
     static bool getAllowUnobservedAsmJS(JSContext* cx, unsigned argc, Value* vp);
     static bool setAllowUnobservedAsmJS(JSContext* cx, unsigned argc, Value* vp);
     static bool getCollectCoverageInfo(JSContext* cx, unsigned argc, Value* vp);
     static bool setCollectCoverageInfo(JSContext* cx, unsigned argc, Value* vp);
     static bool getMemory(JSContext* cx, unsigned argc, Value* vp);
-    static bool getOnIonCompilation(JSContext* cx, unsigned argc, Value* vp);
-    static bool setOnIonCompilation(JSContext* cx, unsigned argc, Value* vp);
     static bool addDebuggee(JSContext* cx, unsigned argc, Value* vp);
     static bool addAllGlobalsAsDebuggees(JSContext* cx, unsigned argc, Value* vp);
     static bool removeDebuggee(JSContext* cx, unsigned argc, Value* vp);
     static bool removeAllDebuggees(JSContext* cx, unsigned argc, Value* vp);
     static bool hasDebuggee(JSContext* cx, unsigned argc, Value* vp);
     static bool getDebuggees(JSContext* cx, unsigned argc, Value* vp);
     static bool getNewestFrame(JSContext* cx, unsigned argc, Value* vp);
     static bool clearAllBreakpoints(JSContext* cx, unsigned argc, Value* vp);
@@ -661,18 +656,16 @@ class Debugger : private mozilla::Linked
     static JSTrapStatus slowPathOnDebuggerStatement(JSContext* cx, AbstractFramePtr frame);
     static JSTrapStatus slowPathOnExceptionUnwind(JSContext* cx, AbstractFramePtr frame);
     static void slowPathOnNewScript(JSContext* cx, HandleScript script);
     static void slowPathOnNewWasmModule(JSContext* cx, Handle<WasmModuleObject*> wasmModule);
     static void slowPathOnNewGlobalObject(JSContext* cx, Handle<GlobalObject*> global);
     static bool slowPathOnLogAllocationSite(JSContext* cx, HandleObject obj, HandleSavedFrame frame,
                                             double when, GlobalObject::DebuggerVector& dbgs);
     static void slowPathPromiseHook(JSContext* cx, Hook hook, HandleObject promise);
-    static void slowPathOnIonCompilation(JSContext* cx, Handle<ScriptVector> scripts,
-                                         LSprinter& graph);
 
     template <typename HookIsEnabledFun /* bool (Debugger*) */,
               typename FireHookFun /* JSTrapStatus (Debugger*) */>
     static JSTrapStatus dispatchHook(JSContext* cx, HookIsEnabledFun hookIsEnabled,
                                      FireHookFun fireHook);
 
     JSTrapStatus fireDebuggerStatement(JSContext* cx, MutableHandleValue vp);
     JSTrapStatus fireExceptionUnwind(JSContext* cx, MutableHandleValue vp);
@@ -722,23 +715,16 @@ class Debugger : private mozilla::Linked
     /*
      * Receive a "garbage collection" event from the engine. A GC cycle with the
      * given data was recently completed.
      */
     void fireOnGarbageCollectionHook(JSContext* cx,
                                      const JS::dbg::GarbageCollectionEvent::Ptr& gcData);
 
     /*
-     * Receive a "Ion compilation" event from the engine. An Ion compilation with
-     * the given summary just got linked.
-     */
-    JSTrapStatus fireOnIonCompilationHook(JSContext* cx, Handle<ScriptVector> scripts,
-                                          LSprinter& graph);
-
-    /*
      * Gets a Debugger.Frame object. If maybeIter is non-null, we eagerly copy
      * its data if we need to make a new Debugger.Frame.
      */
     bool getScriptFrameWithIter(JSContext* cx, AbstractFramePtr frame,
                                 const ScriptFrameIter* maybeIter, MutableHandleValue vp);
 
     inline Breakpoint* firstBreakpoint() const;
 
@@ -849,19 +835,16 @@ class Debugger : private mozilla::Linked
      */
     static inline bool onLeaveFrame(JSContext* cx, AbstractFramePtr frame, jsbytecode* pc, bool ok);
 
     static inline void onNewScript(JSContext* cx, HandleScript script);
     static inline void onNewWasmModule(JSContext* cx, Handle<WasmModuleObject*> wasmModule);
     static inline void onNewGlobalObject(JSContext* cx, Handle<GlobalObject*> global);
     static inline bool onLogAllocationSite(JSContext* cx, JSObject* obj, HandleSavedFrame frame,
                                            double when);
-    static inline bool observesIonCompilation(JSContext* cx);
-    static inline void onIonCompilation(JSContext* cx, Handle<ScriptVector> scripts,
-                                        LSprinter& graph);
     static JSTrapStatus onTrap(JSContext* cx, MutableHandleValue vp);
     static JSTrapStatus onSingleStep(JSContext* cx, MutableHandleValue vp);
     static bool handleBaselineOsr(JSContext* cx, InterpreterFrame* from, jit::BaselineFrame* to);
     static bool handleIonBailout(JSContext* cx, jit::RematerializedFrame* from, jit::BaselineFrame* to);
     static void handleUnrecoverableIonBailoutError(JSContext* cx, jit::RematerializedFrame* frame);
     static void propagateForcedReturn(JSContext* cx, AbstractFramePtr frame, HandleValue rval);
     static bool hasLiveHook(GlobalObject* global, Hook which);
     static bool inFrameMaps(AbstractFramePtr frame);