Bug 1182711 - Ensure usesScopeChain_ is true for heavyweight functions. r=bhackett, a=2.2+
☠☠ backed out by 24092ee0061a ☠ ☠
authorJan de Mooij <jdemooij@mozilla.com>
Wed, 22 Jul 2015 13:36:16 +0200
changeset 238743 f3b9f68f9c9074bf49d6092ceca16cec317930d1
parent 238742 1d69c96a051780a5af9cbc81a79e22b0e5a3c897
child 238744 c9cf0f212fac2486845d7b29eba28ec06d3d276b
push id755
push userryanvm@gmail.com
push dateMon, 27 Jul 2015 23:59:00 +0000
treeherdermozilla-b2g37_v2_2@1ba4654d04a9 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett, 2.2
bugs1182711
milestone37.0
Bug 1182711 - Ensure usesScopeChain_ is true for heavyweight functions. r=bhackett, a=2.2+
js/src/jit/BytecodeAnalysis.cpp
js/src/jit/CompileInfo.h
--- a/js/src/jit/BytecodeAnalysis.cpp
+++ b/js/src/jit/BytecodeAnalysis.cpp
@@ -40,16 +40,21 @@ struct CatchFinallyRange
 };
 
 bool
 BytecodeAnalysis::init(TempAllocator& alloc, GSNCache& gsn)
 {
     if (!infos_.growByUninitialized(script_->length()))
         return false;
 
+    // We need a scope chain if the function is heavyweight.
+    usesScopeChain_ = (script_->functionDelazifying() &&
+                       script_->functionDelazifying()->isHeavyweight());
+    MOZ_ASSERT_IF(script_->hasAnyAliasedBindings(), usesScopeChain_);
+
     jsbytecode* end = script_->codeEnd();
 
     // Clear all BytecodeInfo.
     mozilla::PodZero(infos_.begin(), infos_.length());
     infos_[0].init(/*stackDepth=*/0);
 
     Vector<CatchFinallyRange, 0, JitAllocPolicy> catchFinallyRanges(alloc);
 
--- a/js/src/jit/CompileInfo.h
+++ b/js/src/jit/CompileInfo.h
@@ -454,16 +454,19 @@ class CompileInfo
     bool isObservableFrameSlot(uint32_t slot) const {
         if (!funMaybeLazy())
             return false;
 
         // The |this| value must always be observable.
         if (slot == thisSlot())
             return true;
 
+        if (funMaybeLazy()->isHeavyweight() && slot == scopeChainSlot())
+            return true;
+
         // If the function may need an arguments object, then make sure to
         // preserve the scope chain, because it may be needed to construct the
         // arguments object during bailout. If we've already created an
         // arguments object (or got one via OSR), preserve that as well.
         if (hasArguments() && (slot == scopeChainSlot() || slot == argsObjSlot()))
             return true;
 
         return false;