tor-browser

commit 53460b98de66aafc8404787a86ae721b8ee931c3
parent 14e68309490212624913c7b8acbbae1ac058382d
Author: Hannes Verschore <hv1989@gmail.com>
Date:   Fri, 19 Dec 2025 19:14:59 +0000

Bug 2004346: Add jit-test options to enable/disable stubfolding. r=iain

Differential Revision: https://phabricator.services.mozilla.com/D275206

Diffstat:
M
js/src/jit/JitOptions.cpp
 | 
6
++++++
M
js/src/jit/JitOptions.h
 | 
2
++
M
js/src/jit/StubFolding.cpp
 | 
8
++++++++
M
js/src/shell/js.cpp
 | 
26
++++++++++++++++++++++++++

4 files changed, 42 insertions(+), 0 deletions(-)
diff --git a/js/src/jit/JitOptions.cpp b/js/src/jit/JitOptions.cpp
@@ -117,6 +117,12 @@ DefaultJitOptions::DefaultJitOptions() {
   // Toggles whether CacheIR stubs are used.
   SET_DEFAULT(disableCacheIR, false);
 
+  // Toggles whether stubs are folded.
+  SET_DEFAULT(disableStubFolding, false);
+
+  // Toggles whether stubs with different offsets in Loads or Stores are folded.
+  SET_DEFAULT(disableStubFoldingLoadsAndStores, false);
+
   // Toggles whether sink code motion is globally disabled.
   SET_DEFAULT(disableSink, true);
 
diff --git a/js/src/jit/JitOptions.h b/js/src/jit/JitOptions.h
@@ -66,6 +66,8 @@ struct DefaultJitOptions {
   bool disableRecoverIns;
   bool disableScalarReplacement;
   bool disableCacheIR;
+  bool disableStubFolding;
+  bool disableStubFoldingLoadsAndStores;
   bool disableSink;
   bool disableRedundantShapeGuards;
   bool disableRedundantGCBarriers;
diff --git a/js/src/jit/StubFolding.cpp b/js/src/jit/StubFolding.cpp
@@ -250,6 +250,10 @@ static bool TryFoldingGuardShapes(JSContext* cx, ICFallbackStub* fallback,
   CacheIRCloner cloner(firstStub);
   bool hasSlotOffsets = offsetList.length() > 1;
 
+  if (JitOptions.disableStubFoldingLoadsAndStores && hasSlotOffsets) {
+    return true;
+  }
+
   // Initialize the operands.
   CacheKind cacheKind = stubInfo->kind();
   for (uint32_t i = 0; i < NumInputsForCacheKind(cacheKind); i++) {
@@ -444,6 +448,10 @@ bool js::jit::TryFoldingStubs(JSContext* cx, ICFallbackStub* fallback,
   ICEntry* icEntry = icScript->icEntryForStub(fallback);
   ICStub* entryStub = icEntry->firstStub();
 
+  if (JitOptions.disableStubFolding) {
+    return true;
+  }
+
   // Don't fold unless there are at least two stubs.
   if (entryStub == fallback) {
     return true;
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
@@ -13028,6 +13028,12 @@ bool InitOptionParser(OptionParser& op) {
                           "call to enable work-in-progress call ICs)") ||
       !op.addStringOption('\0', "ion-shared-stubs", "on/off",
                           "Use shared stubs (default: on, off to disable)") ||
+      !op.addStringOption(
+          '\0', "stub-folding", "on/off",
+          "Enable stub folding (default: on, off to disable)") ||
+      !op.addStringOption('\0', "stub-folding-loads-and-stores", "on/off",
+                          "Enable stub folding for load and stores (default: "
+                          "on, off to disable)") ||
       !op.addStringOption('\0', "ion-scalar-replacement", "on/off",
                           "Scalar Replacement (default: on, off to disable)") ||
       !op.addStringOption('\0', "ion-gvn", "[mode]",
@@ -13862,6 +13868,26 @@ bool SetContextJITOptions(JSContext* cx, const OptionParser& op) {
     }
   }
 
+  if (const char* str = op.getStringOption("stub-folding")) {
+    if (strcmp(str, "on") == 0) {
+      jit::JitOptions.disableStubFolding = false;
+    } else if (strcmp(str, "off") == 0) {
+      jit::JitOptions.disableStubFolding = true;
+    } else {
+      return OptionFailure("stub-folding", str);
+    }
+  }
+
+  if (const char* str = op.getStringOption("stub-folding-loads-and-stores")) {
+    if (strcmp(str, "on") == 0) {
+      jit::JitOptions.disableStubFoldingLoadsAndStores = false;
+    } else if (strcmp(str, "off") == 0) {
+      jit::JitOptions.disableStubFoldingLoadsAndStores = true;
+    } else {
+      return OptionFailure("stub-folding-loads-and-stores", str);
+    }
+  }
+
   if (const char* str = op.getStringOption("spectre-mitigations")) {
     if (strcmp(str, "on") == 0) {
 #if defined(JS_CODEGEN_RISCV64) || defined(JS_CODEGEN_LOONG64) || \