Add m-esr52 at 52.6.0

1 files changed, 219 insertions, 0 deletions

diff --git a/js/src/jit/Bailouts.h b/js/src/jit/Bailouts.h
new file mode 100644
index 000000000..747f59b7d
--- /dev/null
+++ b/js/src/jit/Bailouts.h
@@ -0,0 +1,219 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef jit_Bailouts_h
+#define jit_Bailouts_h
+
+#include "jstypes.h"
+
+#include "jit/JitFrameIterator.h"
+#include "jit/JitFrames.h"
+#include "vm/Stack.h"
+
+namespace js {
+namespace jit {
+
+// A "bailout" is a condition in which we need to recover an interpreter frame
+// from an IonFrame. Bailouts can happen for the following reasons:
+//   (1) A deoptimization guard, for example, an add overflows or a type check
+//       fails.
+//   (2) A check or assumption held by the JIT is invalidated by the VM, and
+//       JIT code must be thrown away. This includes the GC possibly deciding
+//       to evict live JIT code, or a Type Inference reflow.
+//
+// Note that bailouts as described here do not include normal Ion frame
+// inspection, for example, if an exception must be built or the GC needs to
+// scan an Ion frame for gcthings.
+//
+// The second type of bailout needs a different name - "deoptimization" or
+// "deep bailout". Here we are concerned with eager (or maybe "shallow")
+// bailouts, that happen from JIT code. These happen from guards, like:
+//
+//  cmp [obj + shape], 0x50M37TH1NG
+//  jmp _bailout
+//
+// The bailout target needs to somehow translate the Ion frame (whose state
+// will differ at each program point) to an interpreter frame. This state is
+// captured into the IonScript's snapshot buffer, and for each bailout we know
+// which snapshot corresponds to its state.
+//
+// Roughly, the following needs to happen at the bailout target.
+//   (1) Move snapshot ID into a known stack location (registers cannot be
+//       mutated).
+//   (2) Spill all registers to the stack.
+//   (3) Call a Bailout() routine, whose argument is the stack pointer.
+//   (4) Bailout() will find the IonScript on the stack, use the snapshot ID
+//       to find the structure of the frame, and then use the stack and spilled
+//       registers to perform frame conversion.
+//   (5) Bailout() returns, and the JIT must immediately return to the
+//       interpreter (all frames are converted at once).
+//
+// (2) and (3) are implemented by a trampoline held in the compartment.
+// Naively, we could implement (1) like:
+//
+//   _bailout_ID_1:
+//     push 1
+//     jmp _global_bailout_handler
+//   _bailout_ID_2:
+//     push 2
+//     jmp _global_bailout_handler
+//
+// This takes about 10 extra bytes per guard. On some platforms, we can reduce
+// this overhead to 4 bytes by creating a global jump table, shared again in
+// the compartment:
+//
+//     call _global_bailout_handler
+//     call _global_bailout_handler
+//     call _global_bailout_handler
+//     call _global_bailout_handler
+//      ...
+//    _global_bailout_handler:
+//
+// In the bailout handler, we can recompute which entry in the table was
+// selected by subtracting the return addressed pushed by the call, from the
+// start of the table, and then dividing by the size of a (call X) entry in the
+// table. This gives us a number in [0, TableSize), which we call a
+// "BailoutId".
+//
+// Then, we can provide a per-script mapping from BailoutIds to snapshots,
+// which takes only four bytes per entry.
+//
+// This strategy does not work as given, because the bailout handler has no way
+// to compute the location of an IonScript. Currently, we do not use frame
+// pointers. To account for this we segregate frames into a limited set of
+// "frame sizes", and create a table for each frame size. We also have the
+// option of not using bailout tables, for platforms or situations where the
+// 10 byte cost is more optimal than a bailout table. See JitFrames.h for more
+// detail.
+
+static const BailoutId INVALID_BAILOUT_ID = BailoutId(-1);
+
+// Keep this arbitrarily small for now, for testing.
+static const uint32_t BAILOUT_TABLE_SIZE = 16;
+
+// Bailout return codes.
+// N.B. the relative order of these values is hard-coded into ::GenerateBailoutThunk.
+static const uint32_t BAILOUT_RETURN_OK = 0;
+static const uint32_t BAILOUT_RETURN_FATAL_ERROR = 1;
+static const uint32_t BAILOUT_RETURN_OVERRECURSED = 2;
+
+// This address is a magic number made to cause crashes while indicating that we
+// are making an attempt to mark the stack during a bailout.
+static uint8_t * const FAKE_JIT_TOP_FOR_BAILOUT = reinterpret_cast<uint8_t*>(0xba1);
+
+// BailoutStack is an architecture specific pointer to the stack, given by the
+// bailout handler.
+class BailoutStack;
+class InvalidationBailoutStack;
+
+// Must be implemented by each architecture.
+
+// This structure is constructed before recovering the baseline frames for a
+// bailout. It records all information extracted from the stack, and which are
+// needed for the JitFrameIterator.
+class BailoutFrameInfo
+{
+    MachineState machine_;
+    uint8_t* framePointer_;
+    size_t topFrameSize_;
+    IonScript* topIonScript_;
+    uint32_t snapshotOffset_;
+    JitActivation* activation_;
+
+    void attachOnJitActivation(const JitActivationIterator& activations);
+
+  public:
+    BailoutFrameInfo(const JitActivationIterator& activations, BailoutStack* sp);
+    BailoutFrameInfo(const JitActivationIterator& activations, InvalidationBailoutStack* sp);
+    BailoutFrameInfo(const JitActivationIterator& activations, const JitFrameIterator& frame);
+    ~BailoutFrameInfo();
+
+    uint8_t* fp() const {
+        return framePointer_;
+    }
+    SnapshotOffset snapshotOffset() const {
+        return snapshotOffset_;
+    }
+    const MachineState* machineState() const {
+        return &machine_;
+    }
+    size_t topFrameSize() const {
+        return topFrameSize_;
+    }
+    IonScript* ionScript() const {
+        return topIonScript_;
+    }
+    JitActivation* activation() const {
+        return activation_;
+    }
+};
+
+MOZ_MUST_USE bool EnsureHasEnvironmentObjects(JSContext* cx, AbstractFramePtr fp);
+
+struct BaselineBailoutInfo;
+
+// Called from a bailout thunk. Returns a BAILOUT_* error code.
+uint32_t Bailout(BailoutStack* sp, BaselineBailoutInfo** info);
+
+// Called from the invalidation thunk. Returns a BAILOUT_* error code.
+uint32_t InvalidationBailout(InvalidationBailoutStack* sp, size_t* frameSizeOut,
+                             BaselineBailoutInfo** info);
+
+class ExceptionBailoutInfo
+{
+    size_t frameNo_;
+    jsbytecode* resumePC_;
+    size_t numExprSlots_;
+
+  public:
+    ExceptionBailoutInfo(size_t frameNo, jsbytecode* resumePC, size_t numExprSlots)
+      : frameNo_(frameNo),
+        resumePC_(resumePC),
+        numExprSlots_(numExprSlots)
+    { }
+
+    ExceptionBailoutInfo()
+      : frameNo_(0),
+        resumePC_(nullptr),
+        numExprSlots_(0)
+    { }
+
+    bool catchingException() const {
+        return !!resumePC_;
+    }
+    bool propagatingIonExceptionForDebugMode() const {
+        return !resumePC_;
+    }
+
+    size_t frameNo() const {
+        MOZ_ASSERT(catchingException());
+        return frameNo_;
+    }
+    jsbytecode* resumePC() const {
+        MOZ_ASSERT(catchingException());
+        return resumePC_;
+    }
+    size_t numExprSlots() const {
+        MOZ_ASSERT(catchingException());
+        return numExprSlots_;
+    }
+};
+
+// Called from the exception handler to enter a catch or finally block.
+// Returns a BAILOUT_* error code.
+uint32_t ExceptionHandlerBailout(JSContext* cx, const InlineFrameIterator& frame,
+                                 ResumeFromException* rfe,
+                                 const ExceptionBailoutInfo& excInfo,
+                                 bool* overrecursed);
+
+uint32_t FinishBailoutToBaseline(BaselineBailoutInfo* bailoutInfo);
+
+void CheckFrequentBailouts(JSContext* cx, JSScript* script, BailoutKind bailoutKind);
+
+} // namespace jit
+} // namespace js
+
+#endif /* jit_Bailouts_h */