android: disable JIT in SM to workaround #31134 (#31270)

The crash when loading servo.org happens in the JIT code
emitted by SM's CacheIRCompiler to invoke the VM function
`ProxyGetPropertyByValue`.

To disable this code path, it is not sufficient to disable
just the baseline JIT (which exposed in servo under the
pref `js.baseline.enabled`) but also the baseline
interpreter which is controlled by a different flag in SM.

This PR disables renames the `js.baseline.enabled` pref in
Servo to `js.baseline_jit.enabled` and introduces a new
pref `js.baseline_interpreter.enabled` that controls the
baseline interpreter.

Signed-off-by: Mukilan Thiyagarajan <mukilan@igalia.com>
This commit is contained in:
Mukilan Thiyagarajan 2024-02-07 09:29:28 +05:30 committed by GitHub
parent 64116eff20
commit d8958f9693
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 23 additions and 6 deletions

View file

@ -55,8 +55,9 @@
"gfx.texture-swizzling.enabled": true,
"js.asmjs.enabled": true,
"js.asyncstack.enabled": false,
"js.baseline.enabled": true,
"js.baseline.unsafe_eager_compilation.enabled": false,
"js.baseline_interpreter.enabled": true,
"js.baseline_jit.enabled": true,
"js.baseline_jit.unsafe_eager_compilation.enabled": false,
"js.discard_system_source.enabled": false,
"js.dump_stack_on_debuggee_would_run.enabled": false,
"js.ion.enabled": true,