IonMonkey PPC backend

[GoogleCodeExporter]

from dvander to m.dev.tech.js-engine today,

IonMonkey has now landed on mozilla-central (yay!). Largely this shouldn't 
affect anyone doing SpiderMonkey development, but in case it does, here are the 
big takeaway changes:

(0) Benchmarks (usually) get faster. Compiling the shell does not. Sorry :(

(1) By running the shell, the flags "--ion -m -n" are now implied by default. 
You can disable them respectively with "--no-ion", "--no-jm", and "--no-ti". 
Disabling TI disables IonMonkey.

In the browser, there is one new JS pref: "javascript.options.ion.content". We 
don't expose any other flags since they'd only exist to horribly break stuff.

(2) IonMonkey, unlike JM, does not use the interpreter stack to store local 
variables and frames. It uses the C stack. This means that cx->fp(), 
js_GetTopStackFrame(), etc, must not be used unless with great care. Even if 
you have a js::StackFrame, it is not okay to peek at it because it could be 
stale.

When in doubt, use the wonderful ScriptFrameIter class. It has abstractions for 
walking the stack and inspecting frames so you don't ever have to touch a 
js::StackFrame.

(3) Lastly, IonMonkey introduces new ways to get in and out of the JIT. 
Briefly, they are:

  (a) At function calls or loop edges, we may decide to run a script with IonMonkey. From C++, this goes through ion::Cannon.

  (b) A guard failure, type-inference invalidation, or GC can cause a "bailout". A bailout is when an Ion frame on the stack must be converted back into an interpreter frame. When this happens, interpreter frames are created for each JS frame in the Ion frame (there can be multiple because of inlining), and we resume running the function in the interpreter instead.

-David 

The stack frame stuff could be ... very interesting given our past 
misadventures with stack. For Judgment Day, we will simply disable it, but we 
should start working on it.

Original issue reported on code.google.com by classi...@floodgap.com on 11 Sep 2012 at 8:32

• Blocked on: #179, #219, #224, #245

[GoogleCodeExporter]

Starting program: /Volumes/BruceDeuce/src/mozilla-26.0/obj-ff-dbg/dist/bin/js 
--ion-eager -e var\ i,j=0\;\ for\(i=0\;i\<500000\;i++\)\ \{\ if\(\!\(i\ %\ 
10000\)\)\ print\(j\)\;\ j+=0.8\ \}\ print\(j\)
warning: Could not find malloc init callback function.  
Make sure malloc is initialized before calling functions.
Reading symbols for shared libraries 
....................................................................+++ done
0

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0xffffffff
0x00eae7a8 in ?? ()

Somehow the patch load for the literal 0.8 isn't getting patched to the proper 
location of the double:

0x00eae780:     lwz     r5,2360(r3)
0x00eae784:     li      r0,-128
0x00eae788:     cmplw   r5,r0
0x00eae78c:     bge-    0xeae984
0x00eae790:     li      r0,796
0x00eae794:     stwu    r4,-4(r1)
0x00eae798:     stwu    r5,-4(r1)
0x00eae79c:     lfd     f3,0(r1)
0x00eae7a0:     addi    r1,r1,8
0x00eae7a4:     li      r12,-1      << XXX (possibly should be x_p_li32)
0x00eae7a8:     lfd     f4,0(r12)   << fault
0x00eae7ac:     fadd    f5,f3,f4
0x00eae7b0:     stfd    f5,2360(r3)
0x00eae7b4:     lwz     r4,2356(r3)
0x00eae7b8:     lwz     r5,2352(r3)
0x00eae7bc:     li      r0,-127

Original comment by classi...@floodgap.com on 14 Jan 2014 at 4:15

[GoogleCodeExporter]

The DoubleMap code I stole from x86 doesn't seem to be emitting the correct 
value to r12 to load the double. If I change it to directly load the double 
from the value index in the DoubleMap, it does work, but I'm worried this is 
not compatible with GC just in case the elements of the DoubleMap move in 
memory. For now using a shim where we break the double into GPRs at compile 
time and load it from the stack, which is slower, but safer. Literal doubles 
now work.

Original comment by classi...@floodgap.com on 14 Jan 2014 at 4:50

[GoogleCodeExporter]

The getOsiIndex hack won't work for function calls.

Starting program: /Volumes/BruceDeuce/src/mozilla-26.0/obj-ff-dbg/dist/bin/js 
--ion-eager -e function\ f\(\)\ \{\ print\(\"ok\"\)\;\ \}\ f\(\)\;
warning: Could not find malloc init callback function.  
Make sure malloc is initialized before calling functions.
Reading symbols for shared libraries 
....................................................................+++ done
[Invalidate]    invalidation thunk created at 0xe751b0
[Invalidate] Start invalidation.
[Invalidate]  Invalidate -e:1, IonScript 0x1d25300
[Invalidate] BEGIN invalidating activation
[Invalidate] #1 exit frame @ 0xbfffebc4
[Invalidate] #2 Optimized JS frame @ 0xbfffec58, -e:1 (fun: 0x0, script: 
0x2a29100, pc 0xe9c22c)
[Invalidate]    ! Invalidate ionScript 0x1d25300 (ref 2) -> patching osipoint 
0xe9c088
[Invalidate] END invalidating activation
[Invalidate] IonScript 0x1d25300 has method 0x2a3a150 raw 0xe9c010
[Invalidate] !! getOsiIndex salvage 00000218: trying 00000028
[Invalidate] !! getOsiIndex salvage 00000218: trying 0000006c
[Invalidate] !! getOsiIndex salvage 00000218: trying 0000007c
[Invalidate] !! getOsiIndex salvage 00000218: trying 00000184
[Invalidate] !! getOsiIndex desperation guess: 00000184
[Bailouts] Took invalidation bailout! Snapshot offset: 62
[Invalidate] IonScript 0x1d25300 has method 0x2a3a150 raw 0xe9c010
[Invalidate] !! getOsiIndex salvage 00000218: trying 00000028
[Invalidate] !! getOsiIndex salvage 00000218: trying 0000006c
[Invalidate] !! getOsiIndex salvage 00000218: trying 0000007c
[Invalidate] !! getOsiIndex salvage 00000218: trying 00000184
[Invalidate] !! getOsiIndex desperation guess: 00000184
[Bailouts] Took invalidation bailout! Snapshot offset: 62
Assertion failure: script, at 
/Volumes/BruceDeuce/src/mozilla-26.0/js/src/jit/IonFrames.cpp:169

My bet is that the guess is wrong and it selected the wrong snapshot for 
invalidation. I really have no idea which snapshot is correct here.

Making CodeGeneratorShared::setOsiIndex() flush the constant pool before 
grabbing masm.label().offset() doesn't seem to fix this, though the indices 
change. I don't know if we're passing the wrong PC back from the bailout.

Original comment by classi...@floodgap.com on 14 Jan 2014 at 2:54

[GoogleCodeExporter]

So, a little progress:

- The bailout thunk must push LR (wound back by a call stanza minus a branch 
instruction) and the frame class even though the x86 version implies this isn't 
necessary.
- Noticed that when the OsiIndex is over the top, if you take the delta and 
wind it back a call stanza, you get a valid OsiIndex. So far that works. Not 
sure if it's right, but it does allow compilation to proceed.
- The bailout works fine for a frameClass that is not -1 
(NO_FRAME_SIZE_CLASS_ID). For that problematic frame class, script compilation 
crashes during the call to Bailout() in the bailout thunk generated by the 
trampoline. We may need to do something different with the stack pushes in this 
case, maybe just push the class -1 and not push LR.

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0xc0e7313c
js::jit::IonFrameIterator::script (this=0xbfffd820) at 
/Volumes/BruceDeuce/src/mozilla-26.0/js/src/jit/IonFrames.cpp:1706
1706    } // namespace js
(gdb) disas $pc-16 $pc+16
Dump of assembler code from 0x4c8e08 to 0x4c8e28:
0x004c8e08 <_ZNK2js3jit16IonFrameIterator6scriptEv+44>: bgt-    cr7,0x4c8f24 
<_ZNK2js3jit16IonFrameIterator6scriptEv+328>
0x004c8e0c <_ZNK2js3jit16IonFrameIterator6scriptEv+48>: cmpwi   cr7,r0,1
0x004c8e10 <_ZNK2js3jit16IonFrameIterator6scriptEv+52>: lwz     r2,0(r3)
0x004c8e14 <_ZNK2js3jit16IonFrameIterator6scriptEv+56>: beq-    cr7,0x4c8e7c 
<_ZNK2js3jit16IonFrameIterator6scriptEv+160>
0x004c8e18 <_ZNK2js3jit16IonFrameIterator6scriptEv+60>: lwz     r29,8(r2)
0x004c8e1c <_ZNK2js3jit16IonFrameIterator6scriptEv+64>: clrlwi  r0,r29,30
0x004c8e20 <_ZNK2js3jit16IonFrameIterator6scriptEv+68>: cmpwi   cr7,r0,3
0x004c8e24 <_ZNK2js3jit16IonFrameIterator6scriptEv+72>: beq-    cr7,0x4c8f4c 
<_ZNK2js3jit16IonFrameIterator6scriptEv+368>
End of assembler dump.
(gdb) i reg r2
r2             0xc0e73134       3236376884
(gdb) i reg r3
r3             0xbfffd820       3221215264

Original comment by classi...@floodgap.com on 17 Jan 2014 at 5:33

[GoogleCodeExporter]

(gdb) x/16w $r3
0xbfffd820:     0xc0e73134      0x00000000      0x00000000      0x00000000
0xbfffd830:     0x00000000      0xbfffdde8      0xbfffdb54      0xbfffdb58
0xbfffd840:     0xbfffdb5c      0xbfffdb60      0xbfffdb64      0xbfffdb68
0xbfffd850:     0xbfffdb6c      0xbfffdb70      0xbfffdb74      0xbfffdb78
(gdb) x/16w $r3-16
0xbfffd810:     0x00000001      0x0065c9fc      0x00000000      0xbfffdde8
0xbfffd820:     0xc0e73134      0x00000000      0x00000000      0x00000000
0xbfffd830:     0x00000000      0xbfffdde8      0xbfffdb54      0xbfffdb58
0xbfffd840:     0xbfffdb5c      0xbfffdb60      0xbfffdb64      0xbfffdb68
(gdb) x/16w 0xbfffdde8
0xbfffdde8:     0x01d08e50      0x0204d200      0xbfffeab8      0x00000000
0xbfffddf8:     0x00000001      0xbfffe8a0      0x01d08e50      0x00000000
0xbfffde08:     0x00000001      0x00000000      0x00e38088      0x00e38cf8
0xbfffde18:     0x0204d200      0x00000000      0x01d08e74      0xbfffde68
(gdb) x/16w 0xbfffeab8
0xbfffeab8:     0x01d08e50      0x0204d200      0x00000000      0x00000000
0xbfffeac8:     0x00000001      0x00000000      0x00000000      0x00000000
0xbfffead8:     0x00000001      0x00000000      0x00e38088      0x00e38cf8
0xbfffeae8:     0x0204d200      0x00000000      0x01d08e74      0xbfffeb38

Original comment by classi...@floodgap.com on 17 Jan 2014 at 5:39

[GoogleCodeExporter]

More small progress. Altered the code generator and bailout thunk to use LR for 
the frame size or the bailout return address depending on how it's called. With 
this change, we still pass all previous tests and in the function test get 
through the invalidation bailout but crash in the second bailout. In this 
intentionally wrong script:

Starting program: /Volumes/BruceDeuce/src/mozilla-26.0/obj-ff-dbg/dist/bin/js 
--ion-eager -e f\(\)\;\ function\ f\(\)\ \{\ print\(\"ok\"\)\;\ \}\ function\ 
g\(\)\ \{\ var\ i=5\;\ \}
warning: Could not find malloc init callback function.  
Make sure malloc is initialized before calling functions.
Reading symbols for shared libraries 
....................................................................+++ done
[Invalidate]    invalidation thunk created at 0xe751b0
[Invalidate] Start invalidation.
[Invalidate]  Invalidate -e:1, IonScript 0x2056600
[Invalidate] BEGIN invalidating activation
[Invalidate] #1 exit frame @ 0xbfffe884
[Invalidate] #2 Optimized JS frame @ 0xbfffe918, -e:1 (fun: 0x0, script: 
0x2a29100, pc 0xe9c270)
[Invalidate]    ! Invalidate ionScript 0x2056600 (ref 2) -> patching osipoint 
0xe9c0cc
[Invalidate] END invalidating activation
[Invalidate] IonScript 0x2056600 has method 0x2a3a150 raw 0xe9c010
[Invalidate] !! getOsiIndex salvage 0000025c: trying 00000028
[Invalidate] !! getOsiIndex salvage 0000025c: trying 0000006c
[Invalidate] !! getOsiIndex salvage 0000025c: trying 000000b0
[Invalidate] !! getOsiIndex salvage 0000025c: trying 000000c0
[Invalidate] !! getOsiIndex salvage 0000025c: trying 000001c8
[Invalidate] !! getOsiIndex desperation guess: 0000008c
[Invalidate] !! getOsiIndex salvage 0000008c: trying 00000028
[Invalidate] !! getOsiIndex salvage 0000008c: trying 0000006c
[Invalidate] !! getOsiIndex salvage 0000008c: trying 000000b0
[Invalidate] !!! getOsiIndex current guess: 0000006c
[Invalidate] !! getOsiIndex salvage 0000008c: trying 000000c0
[Invalidate] !! getOsiIndex salvage 0000008c: trying 000001c8
[Bailouts] Took invalidation bailout! Snapshot offset: 10
[Bailouts] ppc-ibi bailout=bfffda68 activations=bfffd828 sp=bfffdbc8 
fp=bfffdc48 frameSize=128
[Bailouts] Took bailout! Snapshot offset: 0

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0xc00e51a7
js::jit::IonFrameIterator::operator++ (this=0xbfffd778) at 
/Volumes/BruceDeuce/src/mozilla-26.0/js/src/jit/IonFrames.cpp:1706
1706    } // namespace js
(gdb) bt 5
#0  js::jit::IonFrameIterator::operator++ (this=0xbfffd778) at 
/Volumes/BruceDeuce/src/mozilla-26.0/js/src/jit/IonFrames.cpp:1706
#1  0x00167f98 in js::ScriptFrameIter::settleOnActivation (this=0xbfffd748) at 
/Volumes/BruceDeuce/src/mozilla-26.0/js/src/vm/Stack.cpp:570
#2  0x00248548 in PopulateReportBlame (cx=<value temporarily unavailable, due 
to optimizations>, report=0xbfffda6c) at Stack.h:1622
#3  0x0024d88c in js_ReportErrorNumberVA (cx=0x1d08e50, flags=Cannot access 
memory at address 0x28
) at /Volumes/BruceDeuce/src/mozilla-26.0/js/src/jscntxt.cpp:825
#4  0x0021908c in JS_ReportErrorNumber (cx=<value temporarily unavailable, due 
to optimizations>, errorCallback=<value temporarily unavailable, due to 
optimizations>, userRef=<value temporarily unavailable, due to optimizations>, 
errorNumber=<value temporarily unavailable, due to optimizations>) at 
/Volumes/BruceDeuce/src/mozilla-26.0/js/src/jsapi.cpp:5590
(More stack frames follow...)
(gdb) x/16w 0xbfffd778
0xbfffd778:     0xc00e51a3      0x0000000c      0x00008000      0x000e7557
0xbfffd788:     0x00000000      0xbfffdde8      0x00000000      0x00000000
0xbfffd798:     0x00000000      0x0038be94      0x00000000      0x00000000
0xbfffd7a8:     0xbfffe610      0x01d08e80      0x00000000      0xbfffdd60
(gdb) x/16w 0xbfffd770
0xbfffd770:     0xbfffdc44      0xbfffdde8      0xc00e51a3      0x0000000c
0xbfffd780:     0x00008000      0x000e7557      0x00000000      0xbfffdde8
0xbfffd790:     0x00000000      0x00000000      0x00000000      0x0038be94
0xbfffd7a0:     0x00000000      0x00000000      0xbfffe610      0x01d08e80
(gdb) x/16w 0xbfffdde8
0xbfffdde8:     0x01d08e50      0x0204d200      0xbfffeab8      0x00000000
0xbfffddf8:     0x00000001      0xbfffe8a0      0x01d08e50      0x00000000
0xbfffde08:     0x00000001      0x00000000      0x00e38088      0x00e38cf8
0xbfffde18:     0x0204d200      0x00000000      0x01d08e74      0xbfffde68
(gdb) x/16w 0xbfffdc44
0xbfffdc44:     0x00008000      0x00e7557c      0x00000103      0x02a34c80
0xbfffdc54:     0x00000000      0xffffff82      0x00000000      0xbfffdcd0
0xbfffdc64:     0x01d08e50      0xbfffdc70      0x01a45d40      0xbfffdcd0
0xbfffdc74:     0x00000002      0x01a45d74      0x00454c58      0xbfffdcd0

Original comment by classi...@floodgap.com on 21 Jan 2014 at 4:27

[GoogleCodeExporter]

A combination of the following are needed to get function calls working (now 
they do):

- CodeGenerator-shared has to flush the constant pool whenever there is an 
OsiIndex emitted, or our salvage routine does indeed get the wrong snapshot. 
This is a bit of a pain since snapshots are taken every couple Ion IRops.
- We were taking an extra word off the stack in the invalidation thunk we 
shouldn't have been, and clobbering r3 in the process.

Original comment by classi...@floodgap.com on 22 Jan 2014 at 4:30

[GoogleCodeExporter]

getOsiIndex (OsiIndicies) are not fixed by preserving LR. The delta write 
always overwrites the call minus a call stanza. We need to alter how the 
OsiPoint is written, which probably means hacking visitOsiPoint.

(gdb) disas (0x1cbb010+0x440) (0x1cbb010+0x490)
Dump of assembler code from 0x1cbb450 to 0x1cbb4a0:
0x01cbb450:     mflr    r0
0x01cbb454:     bl      0x1cbb458
0x01cbb458:     mflr    r12
0x01cbb45c:     mtlr    r0
0x01cbb460:     addi    r12,r12,32
0x01cbb464:     stwu    r12,-4(r1)
0x01cbb468:     .long 0x6c0          << rewound by a call stanza
0x01cbb46c:     ori     r0,r0,8096
0x01cbb470:     mtctr   r0
0x01cbb474:     bctrl

Notice preserving LR made no difference, so I'm going to revert that.

Original comment by classi...@floodgap.com on 2 Jun 2014 at 1:50

[GoogleCodeExporter]

(i.e., change markOsiPoint to mark it after the bctrl)

Original comment by classi...@floodgap.com on 2 Jun 2014 at 1:51

[GoogleCodeExporter]

I don't understand how ARM is accomplishing this! It's got a link register too!

Original comment by classi...@floodgap.com on 4 Jun 2014 at 3:31

[GoogleCodeExporter]

It seems that when the bailoutId is non-zero, we fail. The bailout table looks 
weird.

Original comment by classi...@floodgap.com on 4 Jun 2014 at 4:16

Attachments:

• run1.txt
• run2.txt

[GoogleCodeExporter]

Manually rewrote the bailout table. No help. It doesn't match the Intel run 
through at all. Even if I change Ion to make the OsiIndex salvage match the 
same snapshot offset Intel falls through, then it fails to reanalyze the script 
after it bails out to Baseline.

One thing noted: InvalidationBailout was the wrong size, but that doesn't 
explain why we need to make fp() at offset -4 in Ion.cpp.

We get the right answer, but we can't return it.

Original comment by classi...@floodgap.com on 8 Jun 2014 at 7:08

Attachments:

• runx64.txt

[GoogleCodeExporter]

I think the only way to solve this problem is fix the OsiPoint mapping without 
using the guessing algorithm and I have no idea how.

Original comment by classi...@floodgap.com on 8 Jun 2014 at 7:19

[GoogleCodeExporter]

Progress!!! Disabled the debug checks after CodeGenerator's accept(this) and 
now we're getting somewhere!

[Invalidate] IonScript 0x1d1d9e0 has method 0x3a24178 raw 0x1cbb010
[Invalidate] !! getOsiIndex salvage 0000020c: trying 000001c8
[Invalidate] !! getOsiIndex salvage 0000020c: trying 00000210
[Invalidate] !!! getOsiIndex current guess: 000001c8
[Invalidate] !! getOsiIndex salvage 0000020c: trying 00000380
Assertion failure: false (MOZ_ASSUME_UNREACHABLE(Failed to find OSI point 
return address)), at /Volumes/BruceDeuce/src/mozilla-31a/js/src/jit/Ion.cpp:1197

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000000
0x0028e8b0 in js::jit::IonScript::getOsiIndex (this=0x1d1d9e0, disp=524) at 
/Volumes/BruceDeuce/src/mozilla-31a/js/src/jit/Ion.cpp:1197
1197        MOZ_ASSUME_UNREACHABLE("Failed to find OSI point return address");
(gdb) disas 0x1cbb010+0x200 0x1cbb010+0x220
Dump of assembler code from 0x1cbb210 to 0x1cbb230:
0x01cbb210:     ori     r0,r0,65440
0x01cbb214:     mtctr   r0
0x01cbb218:     bctrl
0x01cbb21c:     b       0x1cbb3b4
0x01cbb220:     nop
0x01cbb224:     nop
0x01cbb228:     nop
0x01cbb22c:     mr      r8,r5
End of assembler dump.

Original comment by classi...@floodgap.com on 10 Jun 2014 at 1:49

[GoogleCodeExporter]

Back on IonPower. I'm just going to put things here I need to come back to.

failing test:
function ok(a){print(a.length);}ok("WTF");ok("WTF");

also fails:
a="WTF";function ok(){print(a.length);}ok();ok();

doesn't fail:
function ok(a){x=a.length;print(x);}ok("WTF");ok("WTF");

doesn't fail:
function ok(a){print(a.length);}ok("WTF");

currently solved by suppressing GetName(GlobalName) stub, but I don't see the 
bug, so I suspect this is just affected by wherever the badness still lurks:
[BaselineIC]   Generating GetName(GlobalName) stub
[Codegen] == loadPtr(adr, reg) ==
[Codegen] ////////
[Codegen] 00000000 --- 81c70010 lwz r14,16(r7)
[Codegen] == branch32(cond, adr, reg, l) ==
[Codegen] 00000004 --- 80050000 lwz r0,0(r5)
[Codegen] 00000008 --- 7c007000 cmpw cr0,r0,r14
[Codegen] 0000000c --- 7fe00008 trap
[Codegen] -------- --- ffffffff <<< bc 0024 offset
[Codegen] 00000014 --- 60000000 nop
[Codegen] 00000018 --- 60000000 nop
[Codegen] 0000001c --- 40820004 bc 4,2,4
[Codegen] == loadPtr(adr, reg) ==
[Codegen] 00000020 --- 80a50008 lwz r5,8(r5)
[Codegen] == load32(adr, reg) ==
[Codegen] 00000024 --- 81c70014 lwz r14,20(r7)
[Codegen] == loadValue(bi, vo) ==
[Codegen] 00000028 --- 55c01838 slwi r0,r14,3
[Codegen] 0000002c --- 7d850214 add r12,r5,r0
[Codegen] == loadValue(adr, vo) ==
[Codegen] 00000030 --- 80ac0004 lwz r5,4(r12)
[Codegen] 00000034 --- 80cc0000 lwz r6,0(r12)
[Codegen] == [[ EmitEnterTypeMonitorIC ==
[Codegen] == loadPtr(adr, reg) ==
[Codegen] 00000038 --- 80e7000c lwz r7,12(r7)
[Codegen] == loadPtr(adr, reg) ==
[Codegen] 0000003c --- 80670000 lwz r3,0(r7)
[Codegen] 00000040 --- 7c6903a6 mtspr ctr,r3
[Codegen] 00000044 --- 4e800420 bctr
[Codegen] ==    EmitEnterTypeMonitorIC ]] ==
[Codegen] # ::bind evaluating 0000000c
[Codegen] # ::bind short jump 4 0000000c -> 00000048 offset 60
[Codegen] == [[ EmitStubGuardFailure ==
[Codegen] == loadPtr(adr, reg) ==
[Codegen] 00000048 --- 80670000 lwz r3,0(r7)
[Codegen] 0000004c --- 7c6903a6 mtspr ctr,r3
[Codegen] == loadPtr(adr, reg) ==
[Codegen] 00000050 --- 80e70004 lwz r7,4(r7)
[Codegen] 00000054 --- 4e800420 bctr
[Codegen] ==    EmitStubGuardFailure ]] ==

Original comment by classi...@floodgap.com on 19 Feb 2015 at 5:16

[GoogleCodeExporter]

Current failure list (makes it through test cycle without crashing or 
assertions though I suspect the debug failure may be an infinite loop instead 
of a very slow runtime):

    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/testHeapAcc
ess.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/testZOOB.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/baseline/bug940972
.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/basic/array-length
-double.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/basic/bug620532.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/basic/bug908915.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/basic/hypot-approx.js 
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/basic/testTypedArrayClamping.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/basic/testTypedArrayUint32.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/basic/testTypedArrays.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/ArrayLengthGetPropertyIC.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug1000960.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug750588.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug851792.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug909997.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug915301.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug925305.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/setelem-float32-typedarray-ic.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/typed-arrays-1.js 
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/typed-arrays-2.js 
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/typed-arrays-3.js 
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/jaeger/bug679666.js   
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/jaeger/normalIntTypedArrays.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/jaeger/testIfEqX.js   
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/jaeger/testSetTypedFloatArray.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/jaeger/testSetTypedIntArray.js
TIMEOUTS:
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/debug/Script-getLineOffsets-06.js

Original comment by classi...@floodgap.com on 19 Mar 2015 at 3:35

[GoogleCodeExporter]

Fixed by fixing array-length-double.js:
array-length-double.js
bug620532.js
ArrayLengthGetPropertyIC.js

Let's look at typed arrays now, starting with bug940972.js

Original comment by classi...@floodgap.com on 21 Mar 2015 at 5:33

[GoogleCodeExporter]

Fixed by fixing bug940972.js:
bug940972.js
hypot-approx.js
testTypedArrayClamping.js
testTypedArrayUint32.js
testTypedArrays.js
bug1000960.js
bug750588.js
bug851792.js
bug915301.js
bug925305.js
setelem-float32-typedarray-ic.js
typed-arrays-1.js
typed-arrays-2.js
typed-arrays-3.js
jaeger/bug679666.js
normalIntTypedArrays.js
testSetTypedFloatArray.js
testSetTypedIntArray.js

Still to go:
testIfEqX.js
Script-getLineOffsets-06.js

Verified expected to fail:
bug908915.js: never understood what this one tests anyway
ion/bug909997.js : requires Ion, we will pass eventually

Original comment by classi...@floodgap.com on 21 Mar 2015 at 6:57

[GoogleCodeExporter]

and asm.js/testHeapAccess.js because it assumes little endian memory access

ALL EXPECTED TESTS PASS

Next: feasibility test on Ion. We have to get bailouts to work.

Original comment by classi...@floodgap.com on 21 Mar 2015 at 8:26

[GoogleCodeExporter]

IonPower now completes the test suite without asserting or crashing with 
--ion-eager --ion-offthread-compile=off (the strictest settings). We have a lot 
of failures, which actually suggests a single cause.

FAILURES:
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/testControlFlow.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/testExpressions.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/testFloat32.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/testHeapAccess.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/testResize.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/basic/bug507180.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/basic/bug908915.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/basic/destructuring-iterator.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/basic/testBug504520Harder.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/basic/testLoopWithUndefined2.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/debug/Debugger-findScripts-12.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/debug/Frame-eval-07.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/debug/Frame-live-01.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/debug/Script-sourceStart-03.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/for-of/strings.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug1007213.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug1062612.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug1090424.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug679493.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug716504.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug736135-2.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug736135.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug760103.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug774644.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug816786.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug851792.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug870356.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug889186.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug909997.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/ceil.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/compareAll.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/getelem-hole.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/recover-arrays.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/test-scalar-replacement-float32.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/testFloat32-correctness.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/testInArray.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/typed-arrays-1.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/jaeger/bug643805.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/jaeger/mulNegZero.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/jaeger/inline/mathRound.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/latin1/toLowerCase-toUpperCase.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/pic/watch1a.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/pic/watch2a.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/pic/watch3a.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/pic/watch3b.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/sunspider/check-crypto-sha1.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/sunspider/check-math-partial-sums.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/sunspider/check-math-spectral-norm.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/truthiness/strict-not-equal-undefined.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/v8-v5/check-deltablue.js

Original comment by classi...@floodgap.com on 17 Apr 2015 at 3:45

[GoogleCodeExporter]

First pass. Already much shorter.

FAILURES:
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/testExpressions.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/testFloat32.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/testHeapAccess.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/basic/bug908915.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug1007213.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug1062612.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug679493.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug716504.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug760103.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug774644.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug851792.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug870356.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug909997.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/ceil.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/test-scalar-replacement-float32.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/testFloat32-correctness.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/typed-arrays-1.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/jaeger/mulNegZero.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/jaeger/inline/mathRound.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/sunspider/check-math-partial-sums.js
    /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/sunspider/check-math-spectral-norm.js

Original comment by classi...@floodgap.com on 17 Apr 2015 at 5:05

[GoogleCodeExporter]

Second pass. A little shorter.

FAILURES:
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/testExpressions.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/testFloat32.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/testHeapAccess.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/basic/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/basic/bug908915.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug1007213.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug1062612.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug760103.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug774644.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug851792.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug870356.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/ceil.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/test-scalar-replacement-float32.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/testFloat32-correctness.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/typed-arrays-1.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/jaeger/inline/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/jaeger/inline/mathRound.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/sunspider/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/sunspider/check-math-partial-sums.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/sunspider/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/sunspider/check-math-spectral-norm.js

Original comment by classi...@floodgap.com on 17 Apr 2015 at 10:11

[GoogleCodeExporter]

Reworked rounding and single precision math. 11 failures to go.

    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/testExpressions.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/testFloat32.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/testHeapAccess.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/basic/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/basic/bug908915.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug1007213.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug1062612.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug774644.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug851792.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug870356.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/sunspider/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/sunspider/check-math-partial-sums.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/sunspider/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/sunspider/check-math-spectral-norm.js

Original comment by classi...@floodgap.com on 18 Apr 2015 at 5:58

[GoogleCodeExporter]

(of which only 9 matter -- bug908915 and testHeapAccess are expected to fail)

Original comment by classi...@floodgap.com on 18 Apr 2015 at 5:59

[GoogleCodeExporter]

Fixed bad codegen with x_srwi/x_slwi.

    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/asm.js/testHeapAccess.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/basic/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/basic/bug908915.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug774644.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug851792.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug870356.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/sunspider/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/sunspider/check-math-partial-sums.js
    /Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager --ion-offthread-compile=off -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const platform='darwin'; const libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/sunspider/'" -f /Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/sunspider/check-math-spectral-norm.js

Original comment by classi...@floodgap.com on 19 Apr 2015 at 1:09

[GoogleCodeExporter]

Down to one failing test case!

/Volumes/BruceDeuce/src/mozilla-36t/obj-ff-dbg/dist/bin/js --ion-eager 
--ion-offthread-compile=off -f 
/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/prolog.js --js-cache 
/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/.js-cache -e "const 
platform='darwin'; const 
libdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/lib/'; const 
scriptdir='/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/'" -f 
/Volumes/BruceDeuce/src/mozilla-36t/js/src/jit-test/tests/ion/bug774644.js

Original comment by classi...@floodgap.com on 24 Apr 2015 at 3:33

[GoogleCodeExporter]

ALL PASS!

Original comment by classi...@floodgap.com on 24 Apr 2015 at 10:36

• Changed state: Verified

[shawnl]

Any chance of this work going into mozilla-central to support Linux-ppc64le?

[classilla]

You're welcome to move the code over, but it won't be me that does it, since I don't have a Power8 or interest in that specific platform currently. If you wanted to do so, you would need to change the code that patches Ion for big-endianness (probably simply revert those changes), make sure the PPC backend was little-endian as well (we essentially assumed big-endian), finish the asm.js work which I abandoned for lack of utility, and change the trampoline for SysV ABI (OS X/ppc is PowerOpen, same as AIX). This is not trivial work, but you're welcome to try.

[shawnl]

but it won't be me that does it

Appears you changed your mind :) http://tenfourfox.blogspot.com/2017/08/and-now-for-several-things-that-are.html

[awilfox]

I'm seriously hoping that a Linux PPC BE backend makes it, too, because some of us are running Taloses (and other post-G5 POWER hardware) in BE mode...

[yhaenggi]

That would even be good for G4/G5's running linux.

[classilla]

The JIT I'm planning to write unfortunately won't address either of those cases; it will be a 64-bit ("nunbox") little-endian JIT for POWER9, since that's how I run my own Talos. The folks working on a Chromium port are also running the JIT in LE.

It would still be possible to get a BE JIT working, but you'd still need to hack the core JIT to get around certain glitches with slot ordering (the 64-bit version may be better in this regard) and to get Wasm up you'll have to go whole hog and byteswap everything to and from typed arrays. TenFourFox only does this for integers since there are specific instructions that let us do that with no penalty. FPRs would have to be spilled and reordered. It would suck, but Wasm code tends to be inherently little-endian since most of it is being built on those platforms.

You could crib some of the patches from here (look for #ifdef JS_CPU_PPC_OSX and #ifdef JS_CODEGEN_PPC_OSX) but it would need to be adapted for what they're doing now.

[classilla]

I should add that it would be easier on Firefox than Chromium. Firefox at least assumes a lot less about the endianness of the machine, whereas I don't believe Chromium has ever run on a BE platform.

[awilfox]

At this point, the Web is crippled on PowerPC due to no JITs in any browser. I don't think I'd waste any time dealing with Wasm in a first-pass port (and, depending on adoption rates of Wasm, ever), when core browsing is suffering so badly.

Other than some papercut gfx bugs (#1339008 and #986328), Firefox runs correctly on PowerPC BE, both 32-bit and 64-bit. It's just dog slow because of a lack of JIT.

Thanks for the pointer towards what I'd need to look for here. I guess if you aren't going to focus there, I can get a head start next week.

[classilla]

By all means. I'm happy to advise if the changesets need explanation. You may need to go back into the old changeset packs to get the original diffs (IonMonkey became a thing in the 38.x timeframe).

One thing you probably also want to do is change it to properly use the link register rather than storing return addresses on top of the stack. This hurt alignment and fouled the LR cache but was the only way to solve certain problems at that time. Now you could just stick it in the generated prologue like any other compiled PPC function, which would be a definite speed improvement.

[darkbasic]

Hi, is there any news on the LE Power9 JIT?

[classilla]

Whatever news is available is on talospace.com. This issue doesn't track its progress.