tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

clear-old-analyses-01.js (1607B)


      1 // |jit-test| error:AllDone
      2 // When we enter debug mode in a compartment, we must throw away all
      3 // analyses in that compartment (debug mode affects the results of
      4 // analysis, so they become out of date). This is true even when we would
      5 // otherwise be retaining jit code and its related data structures for
      6 // animation timing.
      7 
      8 if (typeof gcPreserveCode != "function")
      9  throw('AllDone');
     10 
     11 var g = newGlobal({newCompartment: true});
     12 var dbg = new Debugger;
     13 
     14 g.eval("" +
     15       function fib(n) {
     16         var a = 0, b = 1;
     17         while (n-- > 0)
     18           b = b+a, a = b-a;
     19         return b;
     20       });
     21 
     22 g.fib(20);                      // Cause g.fib to be jitted. This creates an analysis with
     23                                // debug mode off.
     24 
     25 gcPreserveCode();               // Tell the gc to preserve JIT code and analyses by
     26                                // default. A recent call to js::NotifyAnimationActivity
     27                                // could have a similar effect in real life.
     28 
     29 dbg.addDebuggee(g);             // Put g in debug mode. This triggers a GC which must
     30                                // clear all analyses. In the original buggy code, we also
     31                                // release all of g's scripts' JIT code, leading to a
     32                                // recompilation the next time it was called.
     33 
     34 g.fib(20);                      // Run g.fib again, causing it to be re-jitted. If the
     35                                // original analysis is still present, JM will assert,
     36                                // because it is not in debug mode.
     37 
     38 throw('AllDone');