tor-browser

commit 3905f930df89fff78eb4416b1e9d7c0c8971686d
parent 3622a329e9ed8460261f88f94a522b6b70e82503
Author: Iain Ireland <iireland@mozilla.com>
Date:   Mon,  6 Oct 2025 20:44:48 +0000

Bug 1985224: Don't compile realm-independent self-hosted baseline code off-thread r=bthrall

The JSNullableAutoRealm mechanism that we use for on-thread compilation isn't available off-thread, since it works via the JSContext. It would be possible to manually null the realm pointer in a variety of places, but this seems cleanest and safest. A handful of main-thread compilations isn't a big deal; the whole point of the self-hosted cache is that we only compile each self-hosted function once per runtime.

Differential Revision: https://phabricator.services.mozilla.com/D267135

Diffstat:
A
js/src/jit-test/tests/baseline/bug1985224.js
 | 
11
+++++++++++
M
js/src/jit/BaselineJIT.cpp
 | 
3
+++

2 files changed, 14 insertions(+), 0 deletions(-)
diff --git a/js/src/jit-test/tests/baseline/bug1985224.js b/js/src/jit-test/tests/baseline/bug1985224.js
@@ -0,0 +1,11 @@
+// |jit-test| --baseline-offthread-compile=on; --setpref=experimental.self_hosted_cache=true
+Object.defineProperty(this, "x", {
+  value: {
+    c: function*() {}.constructor
+  }
+})
+x.c()().next();
+setJitCompilerOption("offthread-compilation.enable", 1);
+for (var i = 0; i < 500; i++) {
+  x.c()().next();
+}
diff --git a/js/src/jit/BaselineJIT.cpp b/js/src/jit/BaselineJIT.cpp
@@ -223,6 +223,9 @@ bool BaselineCompileTask::OffThreadBaselineCompilationAvailable(
   if (script->isDebuggee()) {
     return false;
   }
+  if (JS::Prefs::experimental_self_hosted_cache() && script->selfHosted()) {
+    return false;
+  }
   return CanUseExtraThreads();
 }