Bug 1479909 Part 3 - Disable DOM Ion optimizations when recording or replaying, r=bz.
authorBrian Hackett <bhackett1024@gmail.com>
Thu, 30 Aug 2018 11:59:56 -1000
changeset 489552 354e37362d068f8f120d759c6ed61507f46c2918
parent 489551 45649765f2a9efbdde2931a9f2387484a65fb6fc
child 489553 8284cddccf78566ca4dc45272940ccae4b1150df
child 489556 dcecbdfea1143b1ff7e2fdd8466fbc7c5ec393e2
push id9738
push useraciure@mozilla.com
push dateMon, 03 Sep 2018 16:13:51 +0000
treeherdermozilla-beta@f5841408a66c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz
bugs1479909
milestone63.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1479909 Part 3 - Disable DOM Ion optimizations when recording or replaying, r=bz.
js/src/jit/IonBuilder.cpp
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -5460,16 +5460,23 @@ IonBuilder::jsop_call(uint32_t argc, boo
 }
 
 AbortReasonOr<bool>
 IonBuilder::testShouldDOMCall(TypeSet* inTypes, JSFunction* func, JSJitInfo::OpType opType)
 {
     if (!func->isNative() || !func->hasJitInfo())
         return false;
 
+    // Some DOM optimizations cause execution to skip over recorded events such
+    // as wrapper cache accesses, e.g. through GVN or loop hoisting of the
+    // expression which performs the event. Disable DOM optimizations when
+    // recording or replaying to avoid this problem.
+    if (mozilla::recordreplay::IsRecordingOrReplaying())
+        return false;
+
     // If all the DOM objects flowing through are legal with this
     // property, we can bake in a call to the bottom half of the DOM
     // accessor
     DOMInstanceClassHasProtoAtDepth instanceChecker =
         realm->runtime()->DOMcallbacks()->instanceClassMatchesProto;
 
     const JSJitInfo* jinfo = func->jitInfo();
     if (jinfo->type() != opType)