From 430d9134e269c90759923c101f0c7bd698f1b8c9 Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Sat, 13 Apr 2013 15:04:22 +0200
Subject: [PATCH] Bug 860239 - Make Ion OSR a bit more robust against scripts
 with multiple loops. r=bhackett

---
 js/src/ion/Ion.cpp   | 14 +++++++++++++-
 js/src/ion/Ion.h     |  7 +++++++
 js/src/ion/IonCode.h | 10 ++++++++++
 3 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/js/src/ion/Ion.cpp b/js/src/ion/Ion.cpp
index 0d28ba54886..3298897730b 100644
--- a/js/src/ion/Ion.cpp
+++ b/js/src/ion/Ion.cpp
@@ -562,6 +562,7 @@ IonScript::IonScript()
     callTargetEntries_(0),
     refcount_(0),
     recompileInfo_(),
+    osrPcMismatchCounter_(0),
     slowCallCount(0)
 {
 }
@@ -1623,8 +1624,19 @@ ion::CanEnterAtBranch(JSContext *cx, JSScript *script, AbstractFramePtr fp,
         return status;
     }
 
-    if (script->hasIonScript() && script->ionScript()->osrPc() != pc)
+    if (script->ionScript()->osrPc() != pc) {
+        // If we keep failing to enter the script due to an OSR pc mismatch,
+        // invalidate the script to force a recompile.
+        uint32_t count = script->ionScript()->incrOsrPcMismatchCounter();
+
+        if (count > js_IonOptions.osrPcMismatchesBeforeRecompile) {
+            if (!Invalidate(cx, script, SequentialExecution, true))
+                return Method_Error;
+        }
         return Method_Skipped;
+    }
+
+    script->ionScript()->resetOsrPcMismatchCounter();
 
     return Method_Compiled;
 }
diff --git a/js/src/ion/Ion.h b/js/src/ion/Ion.h
index d10eaa9a048..c9e4f0cd8fa 100644
--- a/js/src/ion/Ion.h
+++ b/js/src/ion/Ion.h
@@ -115,6 +115,12 @@ struct IonOptions
     // Default: .125
     double usesBeforeInliningFactor;
 
+    // How many times we will try to enter a script via OSR before
+    // invalidating the script.
+    //
+    // Default: 6,000
+    uint32_t osrPcMismatchesBeforeRecompile;
+
     // How many actual arguments are accepted on the C stack.
     //
     // Default: 4,096
@@ -207,6 +213,7 @@ struct IonOptions
         usesBeforeCompile(1000),
         usesBeforeCompileNoJaeger(40),
         usesBeforeInliningFactor(.125),
+        osrPcMismatchesBeforeRecompile(6000),
         maxStackArgs(4096),
         maxInlineDepth(3),
         smallFunctionMaxInlineDepth(10),
diff --git a/js/src/ion/IonCode.h b/js/src/ion/IonCode.h
index 201c2f94456..0a4aeb1f34b 100644
--- a/js/src/ion/IonCode.h
+++ b/js/src/ion/IonCode.h
@@ -237,6 +237,10 @@ struct IonScript
     // Identifier of the compilation which produced this code.
     types::RecompileInfo recompileInfo_;
 
+    // Number of times we tried to enter this script via OSR but failed due to
+    // a LOOPENTRY pc other than osrPc_.
+    uint32_t osrPcMismatchCounter_;
+
   private:
     inline uint8_t *bottomBuffer() {
         return reinterpret_cast<uint8_t *>(this);
@@ -462,6 +466,12 @@ struct IonScript
     const types::RecompileInfo& recompileInfo() const {
         return recompileInfo_;
     }
+    uint32_t incrOsrPcMismatchCounter() {
+        return ++osrPcMismatchCounter_;
+    }
+    void resetOsrPcMismatchCounter() {
+        osrPcMismatchCounter_ = 0;
+    }
 };
 
 // Execution information for a basic block which may persist after the