tor-browser

commit a9a9189629bb925700b6612d32a51e1c4e01f9a4
parent 65708f6f5b1a16333be7b9cef1dd7072576a3268
Author: Jan de Mooij <jdemooij@mozilla.com>
Date:   Fri, 24 Oct 2025 06:50:23 +0000

Bug 1995923 part 3 - Move more assertions into AssertBaselineFrameCanEnterIon. r=iain

Differential Revision: https://phabricator.services.mozilla.com/D269710

Diffstat:
M
js/src/jit/Ion.cpp
 | 
24
+++++-------------------

1 file changed, 5 insertions(+), 19 deletions(-)
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
@@ -1862,8 +1862,10 @@ static AbortReason IonCompile(JSContext* cx, HandleScript script,
 
 static void AssertBaselineFrameCanEnterIon(JSContext* cx,
                                            BaselineFrame* frame) {
-  MOZ_ASSERT(!frame->isDebuggerEvalFrame());
+  MOZ_ASSERT(jit::IsIonEnabled(cx));
   MOZ_ASSERT(!frame->isEvalFrame());
+  MOZ_ASSERT(frame->script()->canIonCompile());
+  MOZ_ASSERT(!frame->script()->isIonCompilingOffThread());
 
   // Baseline has the same limit for the number of actual arguments, so if we
   // entered Baseline we can also enter Ion.
@@ -2094,14 +2096,10 @@ MethodStatus jit::CanEnterIon(JSContext* cx, RunState& state) {
 
 static MethodStatus BaselineCanEnterAtEntry(JSContext* cx, HandleScript script,
                                             BaselineFrame* frame) {
-  MOZ_ASSERT(jit::IsIonEnabled(cx));
-  MOZ_ASSERT(script->canIonCompile());
-  MOZ_ASSERT(!script->isIonCompilingOffThread());
+  AssertBaselineFrameCanEnterIon(cx, frame);
   MOZ_ASSERT(!script->hasIonScript());
   MOZ_ASSERT(frame->isFunctionFrame());
 
-  AssertBaselineFrameCanEnterIon(cx, frame);
-
   if (script->baselineScript()->hasPendingIonCompileTask()) {
     LinkIonScript(cx, script);
     if (script->hasIonScript()) {
@@ -2126,26 +2124,14 @@ static MethodStatus BaselineCanEnterAtEntry(JSContext* cx, HandleScript script,
 static MethodStatus BaselineCanEnterAtBranch(JSContext* cx, HandleScript script,
                                              BaselineFrame* osrFrame,
                                              jsbytecode* pc) {
-  MOZ_ASSERT(jit::IsIonEnabled(cx));
+  AssertBaselineFrameCanEnterIon(cx, osrFrame);
   MOZ_ASSERT((JSOp)*pc == JSOp::LoopHead);
 
-  // Skip if the script has been disabled.
-  if (!script->canIonCompile()) {
-    return Method_Skipped;
-  }
-
-  // Skip if the script is being compiled off thread.
-  if (script->isIonCompilingOffThread()) {
-    return Method_Skipped;
-  }
-
   // Optionally ignore on user request.
   if (!JitOptions.osr) {
     return Method_Skipped;
   }
 
-  AssertBaselineFrameCanEnterIon(cx, osrFrame);
-
   // Check if the jitcode still needs to get linked and do this
   // to have a valid IonScript.
   if (script->baselineScript()->hasPendingIonCompileTask()) {