Bug 875276 - Don't profile types in scripts until they are compiled by baseline, r=jandem.

js/src/ion/BaselineCompiler.cpp

@@ -67,6 +67,9 @@ BaselineCompiler::compile()
     IonSpew(IonSpew_BaselineScripts, "Baseline compiling script %s:%d (%p)",
             script->filename(), script->lineno, script.get());
 
+    if (cx->typeInferenceEnabled() && !script->ensureHasBytecodeTypeMap(cx))
+        return Method_Error;
+
     // Only need to analyze scripts which are marked |argumensHasVarBinding|, to
     // compute |needsArgsObj| flag.
     if (script->argumentsHasVarBinding()) {

js/src/ion/Ion.cpp

@@ -1477,8 +1477,13 @@ CheckFrame(AbstractFramePtr fp)
 }
 
 static bool
-CheckScript(JSScript *script, bool osr)
+CheckScript(JSContext *cx, JSScript *script, bool osr)
 {
+    if (!script->analyzedArgsUsage() && !script->ensureRanAnalysis(cx)) {
+        IonSpew(IonSpew_Abort, "OOM under ensureRanAnalysis");
+        return false;
+    }
+
     if (osr && script->needsArgsObj()) {
         // OSR-ing into functions with arguments objects is not supported.
         IonSpew(IonSpew_Abort, "OSR script has argsobj");
@@ -1539,7 +1544,7 @@ SequentialCompileContext::checkScriptSize(JSContext *cx, JSScript *script)
 bool
 CanIonCompileScript(JSContext *cx, HandleScript script, bool osr)
 {
-    if (!script->canIonCompile() || !CheckScript(script, osr))
+    if (!script->canIonCompile() || !CheckScript(cx, script, osr))
         return false;
 
     SequentialCompileContext compileContext;
@@ -1569,7 +1574,7 @@ Compile(JSContext *cx, HandleScript script, AbstractFramePtr fp, jsbytecode *osr
         return Method_CantCompile;
     }
 
-    if (!CheckScript(script, bool(osrPc))) {
+    if (!CheckScript(cx, script, bool(osrPc))) {
         IonSpew(IonSpew_Abort, "Aborted compilation of %s:%d", script->filename(), script->lineno);
         return Method_CantCompile;
     }

js/src/jsinfer.cpp

@@ -5522,12 +5522,10 @@ types::MarkIteratorUnknownSlow(JSContext *cx)
     if (JSOp(*pc) != JSOP_ITER)
         return;
 
-    AutoEnterAnalysis enter(cx);
-
-    if (!script->ensureHasTypes(cx)) {
-        cx->compartment->types.setPendingNukeTypes(cx);
+    if (!script->types)
         return;
-    }
+
+    AutoEnterAnalysis enter(cx);
 
     /*
      * This script is iterating over an actual Iterator or Generator object, or
@@ -5613,6 +5611,9 @@ types::TypeDynamicResult(JSContext *cx, JSScript *script, jsbytecode *pc, Type t
 {
     JS_ASSERT(cx->typeInferenceEnabled());
 
+    if (!script->types)
+        return;
+
     AutoEnterAnalysis enter(cx);
 
     /* Directly update associated type sets for applicable bytecodes. */
@@ -5718,6 +5719,9 @@ types::TypeMonitorResult(JSContext *cx, JSScript *script, jsbytecode *pc, const
     if (!(js_CodeSpec[*pc].format & JOF_TYPESET))
         return;
 
+    if (!script->types)
+        return;
+
     AutoEnterAnalysis enter(cx);
 
     if (!script->ensureHasBytecodeTypeMap(cx)) {

js/src/jsinferinlines.h

@@ -557,20 +557,14 @@ void TypeMonitorCallSlow(JSContext *cx, JSObject *callee, const CallArgs &args,
  * Monitor a javascript call, either on entry to the interpreter or made
  * from within the interpreter.
  */
-inline bool
+inline void
 TypeMonitorCall(JSContext *cx, const js::CallArgs &args, bool constructing)
 {
     if (args.callee().isFunction()) {
         JSFunction *fun = args.callee().toFunction();
-        if (fun->isInterpreted()) {
-            if (!fun->nonLazyScript()->ensureHasTypes(cx))
-                return false;
-            if (cx->typeInferenceEnabled())
-                TypeMonitorCallSlow(cx, &args.callee(), args, constructing);
-        }
+        if (fun->isInterpreted() && fun->nonLazyScript()->types && cx->typeInferenceEnabled())
+            TypeMonitorCallSlow(cx, &args.callee(), args, constructing);
     }
-
-    return true;
 }
 
 inline bool
@@ -1062,9 +1056,8 @@ TypeScript::MonitorAssign(JSContext *cx, HandleObject obj, jsid id)
 /* static */ inline void
 TypeScript::SetThis(JSContext *cx, JSScript *script, Type type)
 {
-    if (!cx->typeInferenceEnabled())
+    if (!cx->typeInferenceEnabled() || !script->types)
         return;
-    JS_ASSERT(script->types);
 
     if (!ThisTypes(script)->hasType(type)) {
         AutoEnterAnalysis enter(cx);
@@ -1085,9 +1078,8 @@ TypeScript::SetThis(JSContext *cx, JSScript *script, const js::Value &value)
 /* static */ inline void
 TypeScript::SetArgument(JSContext *cx, JSScript *script, unsigned arg, Type type)
 {
-    if (!cx->typeInferenceEnabled())
+    if (!cx->typeInferenceEnabled() || !script->types)
         return;
-    JS_ASSERT(script->types);
 
     if (!ArgTypes(script, arg)->hasType(type)) {
         AutoEnterAnalysis enter(cx);

js/src/jsinterp.cpp

@@ -410,8 +410,7 @@ js::Invoke(JSContext *cx, CallArgs args, MaybeConstruct construct)
     if (!fun->getOrCreateScript(cx))
         return false;
 
-    if (!TypeMonitorCall(cx, args, construct))
-        return false;
+    TypeMonitorCall(cx, args, construct);
 
     /* Get pointer to new frame/slots, prepare arguments. */
     InvokeFrameGuard ifg;
@@ -545,8 +544,6 @@ js::ExecuteKernel(JSContext *cx, HandleScript script, JSObject &scopeChainArg, c
     if (!cx->stack.pushExecuteFrame(cx, script, thisv, scopeChain, type, evalInFrame, &efg))
         return false;
 
-    if (!script->ensureHasTypes(cx))
-        return false;
     TypeScript::SetThis(cx, script, efg.fp()->thisValue());
 
     Probes::startExecution(script);
@@ -2274,8 +2271,7 @@ BEGIN_CASE(JSOP_FUNCALL)
         DO_NEXT_OP(len);
     }
 
-    if (!TypeMonitorCall(cx, args, construct))
-        goto error;
+    TypeMonitorCall(cx, args, construct);
 
     InitialFrameFlags initial = construct ? INITIAL_CONSTRUCT : INITIAL_NONE;
     bool newType = cx->typeInferenceEnabled() && UseNewType(cx, script, regs.pc);
@@ -2512,6 +2508,8 @@ END_VARLEN_CASE
 
 BEGIN_CASE(JSOP_ARGUMENTS)
     JS_ASSERT(!regs.fp()->fun()->hasRest());
+    if (!script->analyzedArgsUsage() && !script->ensureRanAnalysis(cx))
+        goto error;
     if (script->needsArgsObj()) {
         ArgumentsObject *obj = ArgumentsObject::createExpected(cx, regs.fp());
         if (!obj)

js/src/jsobj.cpp

@@ -1522,8 +1522,6 @@ js::CreateThisForFunctionWithProto(JSContext *cx, HandleObject callee, JSObject
 
     if (res && cx->typeInferenceEnabled()) {
         JSScript *script = callee->toFunction()->nonLazyScript();
-        if (!script->ensureHasTypes(cx))
-            return NULL;
         TypeScript::SetThis(cx, script, types::Type::ObjectType(res));
     }
 
@@ -1551,8 +1549,6 @@ js::CreateThisForFunction(JSContext *cx, HandleObject callee, bool newType)
         JSObject::clear(cx, nobj);
 
         JSScript *calleeScript = callee->toFunction()->nonLazyScript();
-        if (!calleeScript->ensureHasTypes(cx))
-            return NULL;
         TypeScript::SetThis(cx, calleeScript, types::Type::ObjectType(nobj));
 
         return nobj;

js/src/vm/ArgumentsObject.cpp

@@ -353,11 +353,8 @@ ArgSetter(JSContext *cx, HandleObject obj, HandleId id, JSBool strict, MutableHa
         unsigned arg = unsigned(JSID_TO_INT(id));
         if (arg < argsobj.initialLength() && !argsobj.isElementDeleted(arg)) {
             argsobj.setElement(cx, arg, vp);
-            if (arg < script->function()->nargs) {
-                if (!script->ensureHasTypes(cx))
-                    return false;
+            if (arg < script->function()->nargs)
                 types::TypeScript::SetArgument(cx, script, arg, vp);
-            }
             return true;
         }
     } else {