Bug 1700052 part 15 - Use slot number instead of property shape for ArraySpeciesLookup and PromiseLookup. r=jonco

This is a bit faster than getting the slot number from the shape every time.

Differential Revision: https://phabricator.services.mozilla.com/D110262

js/src/builtin/Array.cpp

@@ -4123,8 +4123,9 @@ void js::ArraySpeciesLookup::initialize(JSContext* cx) {
 
   // Get the referred value, ensure it holds the canonical Array[@@species]
   // function.
-  JSObject* speciesGetter = arrayCtor->getGetter(speciesShape);
-  if (!speciesGetter->is<JSFunction>()) {
+  uint32_t speciesGetterSlot = speciesShape->slot();
+  JSObject* speciesGetter = arrayCtor->getGetter(speciesGetterSlot);
+  if (!speciesGetter || !speciesGetter->is<JSFunction>()) {
     return;
   }
   JSFunction* speciesFun = &speciesGetter->as<JSFunction>();
@@ -4145,7 +4146,7 @@ void js::ArraySpeciesLookup::initialize(JSContext* cx) {
   arrayProto_ = arrayProto;
   arrayConstructor_ = arrayCtor;
   arrayConstructorShape_ = arrayCtor->lastProperty();
-  arraySpeciesShape_ = speciesShape;
+  arraySpeciesGetterSlot_ = speciesGetterSlot;
   canonicalSpeciesFunc_ = speciesFun;
   arrayProtoShape_ = arrayProto->lastProperty();
   arrayProtoConstructorSlot_ = ctorShape->slot();
@@ -4178,7 +4179,7 @@ bool js::ArraySpeciesLookup::isArrayStateStillSane() {
   }
 
   // Ensure the species getter contains the canonical @@species function.
-  JSObject* getter = arrayConstructor_->getGetter(arraySpeciesShape_);
+  JSObject* getter = arrayConstructor_->getGetter(arraySpeciesGetterSlot_);
   return getter == canonicalSpeciesFunc_;
 }
 

js/src/builtin/Array.h

@@ -173,7 +173,7 @@ class MOZ_NON_TEMPORARY_CLASS ArraySpeciesLookup final {
    *      To quickly retrieve and ensure that the Array constructor
    *      stored in the slot has not changed.
    *
-   *  Array's shape for the @@species getter. (arraySpeciesShape_)
+   *  Array's slot number for the @@species getter. (arraySpeciesGetterSlot_)
    *  Array's canonical value for @@species (canonicalSpeciesFunc_)
    *      To quickly retrieve and ensure that the @@species getter for Array
    *      has not changed.
@@ -187,10 +187,10 @@ class MOZ_NON_TEMPORARY_CLASS ArraySpeciesLookup final {
   MOZ_INIT_OUTSIDE_CTOR NativeObject* arrayProto_;
   MOZ_INIT_OUTSIDE_CTOR NativeObject* arrayConstructor_;
 
-  // Shape of matching Array, and slot containing the @@species
-  // property, and the canonical value.
+  // Shape of matching Array, and slot containing the @@species property, and
+  // the canonical value.
   MOZ_INIT_OUTSIDE_CTOR Shape* arrayConstructorShape_;
-  MOZ_INIT_OUTSIDE_CTOR Shape* arraySpeciesShape_;
+  MOZ_INIT_OUTSIDE_CTOR uint32_t arraySpeciesGetterSlot_;
   MOZ_INIT_OUTSIDE_CTOR JSFunction* canonicalSpeciesFunc_;
 
   // Shape of matching Array.prototype object, and slot containing the

js/src/vm/NativeObject.h

@@ -1086,13 +1086,19 @@ class NativeObject : public JSObject {
   }
 
   // Returns the GetterSetter for an accessor property.
+  GetterSetter* getGetterSetter(uint32_t slot) const {
+    return getSlot(slot).toGCThing()->as<GetterSetter>();
+  }
   GetterSetter* getGetterSetter(Shape* shape) const {
     MOZ_ASSERT(shape->isAccessorDescriptor());
-    return getSlot(shape->slot()).toGCThing()->as<GetterSetter>();
+    return getGetterSetter(shape->slot());
   }
 
   // Returns the (possibly nullptr) getter or setter object. The shape must be
   // for an accessor property.
+  JSObject* getGetter(uint32_t slot) const {
+    return getGetterSetter(slot)->getter();
+  }
   JSObject* getGetter(Shape* shape) const {
     return getGetterSetter(shape)->getter();
   }

js/src/vm/PromiseLookup.cpp

@@ -50,9 +50,9 @@ bool js::PromiseLookup::isDataPropertyNative(JSContext* cx, NativeObject* obj,
 
 bool js::PromiseLookup::isAccessorPropertyNative(JSContext* cx,
                                                  NativeObject* holder,
-                                                 Shape* shape,
+                                                 uint32_t getterSlot,
                                                  JSNative native) {
-  JSObject* getter = holder->getGetter(shape);
+  JSObject* getter = holder->getGetter(getterSlot);
   return getter && IsNativeFunction(getter, native) &&
          getter->as<JSFunction>().realm() == cx->realm();
 }
@@ -121,7 +121,8 @@ void js::PromiseLookup::initialize(JSContext* cx) {
 
   // Get the referred value, ensure it holds the canonical Promise[@@species]
   // function.
-  if (!isAccessorPropertyNative(cx, promiseCtor, speciesShape,
+  uint32_t speciesGetterSlot = speciesShape->slot();
+  if (!isAccessorPropertyNative(cx, promiseCtor, speciesGetterSlot,
                                 Promise_static_species)) {
     return;
   }
@@ -148,8 +149,8 @@ void js::PromiseLookup::initialize(JSContext* cx) {
 
   state_ = State::Initialized;
   promiseConstructorShape_ = promiseCtor->lastProperty();
-  promiseSpeciesShape_ = speciesShape;
   promiseProtoShape_ = promiseProto->lastProperty();
+  promiseSpeciesGetterSlot_ = speciesGetterSlot;
   promiseResolveSlot_ = resolveShape->slot();
   promiseProtoConstructorSlot_ = ctorShape->slot();
   promiseProtoThenSlot_ = thenShape->slot();
@@ -193,7 +194,7 @@ bool js::PromiseLookup::isPromiseStateStillSane(JSContext* cx) {
   }
 
   // Ensure the species getter contains the canonical @@species function.
-  if (!isAccessorPropertyNative(cx, promiseCtor, promiseSpeciesShape_,
+  if (!isAccessorPropertyNative(cx, promiseCtor, promiseSpeciesGetterSlot_,
                                 Promise_static_species)) {
     return false;
   }

js/src/vm/PromiseLookup.h

@@ -34,7 +34,8 @@ class MOZ_NON_TEMPORARY_CLASS PromiseLookup final {
      *  Promise.prototype's shape (promiseProtoShape_)
      *      To ensure that Promise.prototype has not been modified.
      *
-     *  Promise's shape for the @@species getter. (promiseSpeciesShape_)
+     *  Promise's slot number for the @@species getter
+     *  (promiseSpeciesGetterSlot_)
      *      To quickly retrieve the @@species getter for Promise.
      *
      *  Promise's slot number for resolve (promiseResolveSlot_)
@@ -55,12 +56,12 @@ class MOZ_NON_TEMPORARY_CLASS PromiseLookup final {
   // Shape of matching Promise object.
   MOZ_INIT_OUTSIDE_CTOR Shape* promiseConstructorShape_;
 
-  // Accessor Shape containing the @@species property.
-  MOZ_INIT_OUTSIDE_CTOR Shape* promiseSpeciesShape_;
-
   // Shape of matching Promise.prototype object.
   MOZ_INIT_OUTSIDE_CTOR Shape* promiseProtoShape_;
 
+  // Slot number for the @@species property on the Promise constructor.
+  MOZ_INIT_OUTSIDE_CTOR uint32_t promiseSpeciesGetterSlot_;
+
   // Slots Promise.resolve, Promise.prototype.constructor, and
   // Promise.prototype.then.
   MOZ_INIT_OUTSIDE_CTOR uint32_t promiseResolveSlot_;
@@ -126,7 +127,7 @@ class MOZ_NON_TEMPORARY_CLASS PromiseLookup final {
 
   // Return true if the accessor shape contains the given native.
   static bool isAccessorPropertyNative(JSContext* cx, NativeObject* holder,
-                                       Shape* shape, JSNative native);
+                                       uint32_t getterSlot, JSNative native);
 
  public:
   /** Construct a |PromiseSpeciesLookup| in the uninitialized state. */