tor-browser

commit acc2ce2d534f1898279af841d07f3d740202efea
parent 413bdb4d73f47ecb45a5ce9c4825678865f1512c
Author: Iain Ireland <iireland@mozilla.com>
Date:   Tue, 25 Nov 2025 23:02:42 +0000

Bug 2001279: Ignore failed IC hash when inlining is aborted r=jandem

Differential Revision: https://phabricator.services.mozilla.com/D273667

Diffstat:
A
js/src/jit-test/tests/warp/bug2001279.js
 | 
37
+++++++++++++++++++++++++++++++++++++
M
js/src/jit/WarpOracle.cpp
 | 
1
+

2 files changed, 38 insertions(+), 0 deletions(-)
diff --git a/js/src/jit-test/tests/warp/bug2001279.js b/js/src/jit-test/tests/warp/bug2001279.js
@@ -0,0 +1,37 @@
+// |jit-test| --no-threads
+with ({}) {}
+
+
+function foo() {
+  target();
+}
+
+// A function that can be inlined
+function good() {}
+
+// A function that can't be inlined (because of the asm.js lambda)
+function bad() {
+  if (!bad) {
+    function inner() {
+      "use asm";
+      function f() {}
+      return f;
+    }
+  }
+}
+
+// Compile a version of foo that calls good without inlining it.
+for (var i = 0; i < 1000; i++) {
+  try { foo(); } catch {}
+}
+target = good;
+for (var i = 0; i < 500; i++) {
+  foo();
+}
+
+// Bail out of the ion-compiled version of foo.
+// Attach an IC that calls bad.
+target = bad;
+for (var i = 0; i < 1500; i++) {
+  foo();
+}
diff --git a/js/src/jit/WarpOracle.cpp b/js/src/jit/WarpOracle.cpp
@@ -1403,6 +1403,7 @@ AbortReasonOr<bool> WarpScriptOracle::maybeInlineCall(
           icScript_->removeInlinedChild(loc.bytecodeToOffset(script_));
         }
         fallbackStub->setTrialInliningState(TrialInliningState::Failure);
+        oracle_->ignoreFailedICHash();
         return false;
       }
       case AbortReason::Error: