diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp index 1d4a165ce064..51e7ef2a4461 100644 --- a/js/src/jit/BaselineIC.cpp +++ b/js/src/jit/BaselineIC.cpp @@ -3364,7 +3364,7 @@ TryAttachNativeInDoesNotExistStub(JSContext* cx, HandleScript outerScript, RootedPropertyName name(cx, JSID_TO_ATOM(id)->asPropertyName()); RootedObject lastProto(cx); size_t protoChainDepth = SIZE_MAX; - if (!CheckHasNoSuchProperty(cx, obj.get(), name.get(), lastProto.address(), &protoChainDepth)) + if (!CheckHasNoSuchProperty(cx, obj.get(), id, lastProto.address(), &protoChainDepth)) return true; MOZ_ASSERT(protoChainDepth < SIZE_MAX); diff --git a/js/src/jit/CacheIR.cpp b/js/src/jit/CacheIR.cpp index 86c37e0dbe8d..5464329c1741 100644 --- a/js/src/jit/CacheIR.cpp +++ b/js/src/jit/CacheIR.cpp @@ -20,13 +20,13 @@ using mozilla::Maybe; GetPropIRGenerator::GetPropIRGenerator(JSContext* cx, jsbytecode* pc, ICStubEngine engine, bool* isTemporarilyUnoptimizable, - HandleValue val, HandlePropertyName name, + HandleValue val, HandleValue idVal, MutableHandleValue res) : writer(cx), cx_(cx), pc_(pc), val_(val), - name_(name), + idVal_(idVal), res_(res), engine_(engine), isTemporarilyUnoptimizable_(isTemporarilyUnoptimizable), @@ -52,34 +52,36 @@ GetPropIRGenerator::tryAttachStub() ValOperandId valId(writer.setInputOperandId(0)); + RootedId id(cx_, INTERNED_STRING_TO_JSID(cx_, idVal_.toString())); //XXX + if (val_.isObject()) { RootedObject obj(cx_, &val_.toObject()); ObjOperandId objId = writer.guardIsObject(valId); - if (tryAttachObjectLength(obj, objId)) + if (tryAttachObjectLength(obj, objId, id)) return true; - if (tryAttachNative(obj, objId)) + if (tryAttachNative(obj, objId, id)) return true; - if (tryAttachUnboxed(obj, objId)) + if (tryAttachUnboxed(obj, objId, id)) return true; - if (tryAttachUnboxedExpando(obj, objId)) + if (tryAttachUnboxedExpando(obj, objId, id)) return true; - if (tryAttachTypedObject(obj, objId)) + if (tryAttachTypedObject(obj, objId, id)) return true; - if (tryAttachModuleNamespace(obj, objId)) + if (tryAttachModuleNamespace(obj, objId, id)) return true; - if (tryAttachWindowProxy(obj, objId)) + if (tryAttachWindowProxy(obj, objId, id)) return true; - if (tryAttachProxy(obj, objId)) + if (tryAttachProxy(obj, objId, id)) return true; return false; } - if (tryAttachPrimitive(valId)) + if (tryAttachPrimitive(valId, id)) return true; - if (tryAttachStringLength(valId)) + if (tryAttachStringLength(valId, id)) return true; - if (tryAttachMagicArguments(valId)) + if (tryAttachMagicArguments(valId, id)) return true; return false; @@ -98,7 +100,7 @@ IsCacheableNoProperty(JSContext* cx, JSObject* obj, JSObject* holder, Shape* sha if (*pc == JSOP_GETXPROP) return false; - return CheckHasNoSuchProperty(cx, obj, JSID_TO_ATOM(id)->asPropertyName()); + return CheckHasNoSuchProperty(cx, obj, id); } enum NativeGetPropCacheability { @@ -301,12 +303,11 @@ EmitCallGetterResult(CacheIRWriter& writer, JSObject* obj, JSObject* holder, } bool -GetPropIRGenerator::tryAttachNative(HandleObject obj, ObjOperandId objId) +GetPropIRGenerator::tryAttachNative(HandleObject obj, ObjOperandId objId, HandleId id) { RootedShape shape(cx_); RootedNativeObject holder(cx_); - RootedId id(cx_, NameToId(name_)); NativeGetPropCacheability type = CanAttachNativeGetProp(cx_, obj, id, &holder, &shape, pc_, engine_, isTemporarilyUnoptimizable_); switch (type) { @@ -314,7 +315,7 @@ GetPropIRGenerator::tryAttachNative(HandleObject obj, ObjOperandId objId) return false; case CanAttachReadSlot: if (holder) { - EnsureTrackPropertyTypes(cx_, holder, NameToId(name_)); + EnsureTrackPropertyTypes(cx_, holder, id); if (obj == holder) { // See the comment in StripPreliminaryObjectStubs. if (IsPreliminaryObject(obj)) @@ -335,7 +336,7 @@ GetPropIRGenerator::tryAttachNative(HandleObject obj, ObjOperandId objId) } bool -GetPropIRGenerator::tryAttachWindowProxy(HandleObject obj, ObjOperandId objId) +GetPropIRGenerator::tryAttachWindowProxy(HandleObject obj, ObjOperandId objId, HandleId id) { // Attach a stub when the receiver is a WindowProxy and we are calling some // kinds of JSNative getters on the Window object (the global object). @@ -354,7 +355,6 @@ GetPropIRGenerator::tryAttachWindowProxy(HandleObject obj, ObjOperandId objId) HandleObject windowObj = cx_->global(); RootedShape shape(cx_); RootedNativeObject holder(cx_); - RootedId id(cx_, NameToId(name_)); NativeGetPropCacheability type = CanAttachNativeGetProp(cx_, windowObj, id, &holder, &shape, pc_, engine_, isTemporarilyUnoptimizable_); if (type != CanAttachCallGetter || @@ -379,7 +379,7 @@ GetPropIRGenerator::tryAttachWindowProxy(HandleObject obj, ObjOperandId objId) } bool -GetPropIRGenerator::tryAttachGenericProxy(HandleObject obj, ObjOperandId objId) +GetPropIRGenerator::tryAttachGenericProxy(HandleObject obj, ObjOperandId objId, HandleId id) { MOZ_ASSERT(obj->is()); @@ -389,13 +389,13 @@ GetPropIRGenerator::tryAttachGenericProxy(HandleObject obj, ObjOperandId objId) // the specialized stubs writer.guardNotDOMProxy(objId); - writer.callProxyGetResult(objId, NameToId(name_)); + writer.callProxyGetResult(objId, id); writer.typeMonitorResult(); return true; } bool -GetPropIRGenerator::tryAttachDOMProxyShadowed(HandleObject obj, ObjOperandId objId) +GetPropIRGenerator::tryAttachDOMProxyShadowed(HandleObject obj, ObjOperandId objId, HandleId id) { MOZ_ASSERT(IsCacheableDOMProxy(obj)); @@ -404,7 +404,7 @@ GetPropIRGenerator::tryAttachDOMProxyShadowed(HandleObject obj, ObjOperandId obj // No need for more guards: we know this is a DOM proxy, since the shape // guard enforces a given JSClass, so just go ahead and emit the call to // ProxyGet. - writer.callProxyGetResult(objId, NameToId(name_)); + writer.callProxyGetResult(objId, id); writer.typeMonitorResult(); return true; } @@ -444,7 +444,7 @@ CheckDOMProxyExpandoDoesNotShadow(CacheIRWriter& writer, JSObject* obj, jsid id, } bool -GetPropIRGenerator::tryAttachDOMProxyUnshadowed(HandleObject obj, ObjOperandId objId) +GetPropIRGenerator::tryAttachDOMProxyUnshadowed(HandleObject obj, ObjOperandId objId, HandleId id) { MOZ_ASSERT(IsCacheableDOMProxy(obj)); @@ -452,7 +452,6 @@ GetPropIRGenerator::tryAttachDOMProxyUnshadowed(HandleObject obj, ObjOperandId o RootedNativeObject holder(cx_); RootedShape shape(cx_); - RootedId id(cx_, NameToId(name_)); NativeGetPropCacheability canCache = CanAttachNativeGetProp(cx_, checkObj, id, &holder, &shape, pc_, engine_, isTemporarilyUnoptimizable_); @@ -495,36 +494,35 @@ GetPropIRGenerator::tryAttachDOMProxyUnshadowed(HandleObject obj, ObjOperandId o } bool -GetPropIRGenerator::tryAttachProxy(HandleObject obj, ObjOperandId objId) +GetPropIRGenerator::tryAttachProxy(HandleObject obj, ObjOperandId objId, HandleId id) { if (!obj->is()) return false; // Skim off DOM proxies. if (IsCacheableDOMProxy(obj)) { - RootedId id(cx_, NameToId(name_)); DOMProxyShadowsResult shadows = GetDOMProxyShadowsCheck()(cx_, obj, id); if (shadows == ShadowCheckFailed) { cx_->clearPendingException(); return false; } if (DOMProxyIsShadowing(shadows)) - return tryAttachDOMProxyShadowed(obj, objId); + return tryAttachDOMProxyShadowed(obj, objId, id); MOZ_ASSERT(shadows == DoesntShadow || shadows == DoesntShadowUnique); - return tryAttachDOMProxyUnshadowed(obj, objId); + return tryAttachDOMProxyUnshadowed(obj, objId, id); } - return tryAttachGenericProxy(obj, objId); + return tryAttachGenericProxy(obj, objId, id); } bool -GetPropIRGenerator::tryAttachUnboxed(HandleObject obj, ObjOperandId objId) +GetPropIRGenerator::tryAttachUnboxed(HandleObject obj, ObjOperandId objId, HandleId id) { if (!obj->is()) return false; - const UnboxedLayout::Property* property = obj->as().layout().lookup(name_); + const UnboxedLayout::Property* property = obj->as().layout().lookup(id); if (!property) return false; @@ -544,7 +542,7 @@ GetPropIRGenerator::tryAttachUnboxed(HandleObject obj, ObjOperandId objId) } bool -GetPropIRGenerator::tryAttachUnboxedExpando(HandleObject obj, ObjOperandId objId) +GetPropIRGenerator::tryAttachUnboxedExpando(HandleObject obj, ObjOperandId objId, HandleId id) { if (!obj->is()) return false; @@ -553,7 +551,7 @@ GetPropIRGenerator::tryAttachUnboxedExpando(HandleObject obj, ObjOperandId objId if (!expando) return false; - Shape* shape = expando->lookup(cx_, NameToId(name_)); + Shape* shape = expando->lookup(cx_, id); if (!shape || !shape->hasDefaultGetter() || !shape->hasSlot()) return false; @@ -563,7 +561,7 @@ GetPropIRGenerator::tryAttachUnboxedExpando(HandleObject obj, ObjOperandId objId } bool -GetPropIRGenerator::tryAttachTypedObject(HandleObject obj, ObjOperandId objId) +GetPropIRGenerator::tryAttachTypedObject(HandleObject obj, ObjOperandId objId, HandleId id) { if (!obj->is() || !cx_->runtime()->jitSupportsFloatingPoint || @@ -578,7 +576,7 @@ GetPropIRGenerator::tryAttachTypedObject(HandleObject obj, ObjOperandId objId) StructTypeDescr* structDescr = &typedObj->typeDescr().as(); size_t fieldIndex; - if (!structDescr->fieldIndex(NameToId(name_), &fieldIndex)) + if (!structDescr->fieldIndex(id, &fieldIndex)) return false; TypeDescr* fieldDescr = &structDescr->fieldDescr(fieldIndex); @@ -614,9 +612,9 @@ GetPropIRGenerator::tryAttachTypedObject(HandleObject obj, ObjOperandId objId) } bool -GetPropIRGenerator::tryAttachObjectLength(HandleObject obj, ObjOperandId objId) +GetPropIRGenerator::tryAttachObjectLength(HandleObject obj, ObjOperandId objId, HandleId id) { - if (name_ != cx_->names().length) + if (!JSID_IS_ATOM(id, cx_->names().length)) return false; if (obj->is()) { @@ -654,7 +652,7 @@ GetPropIRGenerator::tryAttachObjectLength(HandleObject obj, ObjOperandId objId) } bool -GetPropIRGenerator::tryAttachModuleNamespace(HandleObject obj, ObjOperandId objId) +GetPropIRGenerator::tryAttachModuleNamespace(HandleObject obj, ObjOperandId objId, HandleId id) { if (!obj->is()) return false; @@ -662,7 +660,7 @@ GetPropIRGenerator::tryAttachModuleNamespace(HandleObject obj, ObjOperandId objI Rooted ns(cx_, &obj->as()); RootedModuleEnvironmentObject env(cx_); RootedShape shape(cx_); - if (!ns->bindings().lookup(NameToId(name_), env.address(), shape.address())) + if (!ns->bindings().lookup(id, env.address(), shape.address())) return false; // Don't emit a stub until the target binding has been initialized. @@ -682,12 +680,12 @@ GetPropIRGenerator::tryAttachModuleNamespace(HandleObject obj, ObjOperandId objI } bool -GetPropIRGenerator::tryAttachPrimitive(ValOperandId valId) +GetPropIRGenerator::tryAttachPrimitive(ValOperandId valId, HandleId id) { JSValueType primitiveType; RootedNativeObject proto(cx_); if (val_.isString()) { - if (name_ == cx_->names().length) { + if (JSID_IS_ATOM(id, cx_->names().length)) { // String length is special-cased, see js::GetProperty. return false; } @@ -710,7 +708,6 @@ GetPropIRGenerator::tryAttachPrimitive(ValOperandId valId) return false; // Instantiate this property, for use during Ion compilation. - RootedId id(cx_, NameToId(name_)); if (IsIonEnabled(cx_)) EnsureTrackPropertyTypes(cx_, proto, id); @@ -729,9 +726,9 @@ GetPropIRGenerator::tryAttachPrimitive(ValOperandId valId) } bool -GetPropIRGenerator::tryAttachStringLength(ValOperandId valId) +GetPropIRGenerator::tryAttachStringLength(ValOperandId valId, HandleId id) { - if (!val_.isString() || name_ != cx_->names().length) + if (!val_.isString() || !JSID_IS_ATOM(id, cx_->names().length)) return false; StringOperandId strId = writer.guardIsString(valId); @@ -741,22 +738,22 @@ GetPropIRGenerator::tryAttachStringLength(ValOperandId valId) } bool -GetPropIRGenerator::tryAttachMagicArguments(ValOperandId valId) +GetPropIRGenerator::tryAttachMagicArguments(ValOperandId valId, HandleId id) { if (!val_.isMagic(JS_OPTIMIZED_ARGUMENTS)) return false; - if (name_ != cx_->names().length && name_ != cx_->names().callee) + if (!JSID_IS_ATOM(id, cx_->names().length) && !JSID_IS_ATOM(id, cx_->names().callee)) return false; writer.guardMagicValue(valId, JS_OPTIMIZED_ARGUMENTS); writer.guardFrameHasNoArgumentsObject(); - if (name_ == cx_->names().length) { + if (JSID_IS_ATOM(id, cx_->names().length)) { writer.loadFrameNumActualArgsResult(); writer.returnFromIC(); } else { - MOZ_ASSERT(name_ == cx_->names().callee); + MOZ_ASSERT(JSID_IS_ATOM(id, cx_->names().callee)); writer.loadFrameCalleeResult(); writer.typeMonitorResult(); } diff --git a/js/src/jit/CacheIR.h b/js/src/jit/CacheIR.h index 83ffdd786f47..ef6ed15c2d2c 100644 --- a/js/src/jit/CacheIR.h +++ b/js/src/jit/CacheIR.h @@ -561,7 +561,7 @@ class MOZ_RAII GetPropIRGenerator JSContext* cx_; jsbytecode* pc_; HandleValue val_; - HandlePropertyName name_; + HandleValue idVal_; MutableHandleValue res_; ICStubEngine engine_; bool* isTemporarilyUnoptimizable_; @@ -569,22 +569,22 @@ class MOZ_RAII GetPropIRGenerator enum class PreliminaryObjectAction { None, Unlink, NotePreliminary }; PreliminaryObjectAction preliminaryObjectAction_; - bool tryAttachNative(HandleObject obj, ObjOperandId objId); - bool tryAttachUnboxed(HandleObject obj, ObjOperandId objId); - bool tryAttachUnboxedExpando(HandleObject obj, ObjOperandId objId); - bool tryAttachTypedObject(HandleObject obj, ObjOperandId objId); - bool tryAttachObjectLength(HandleObject obj, ObjOperandId objId); - bool tryAttachModuleNamespace(HandleObject obj, ObjOperandId objId); - bool tryAttachWindowProxy(HandleObject obj, ObjOperandId objId); + bool tryAttachNative(HandleObject obj, ObjOperandId objId, HandleId id); + bool tryAttachUnboxed(HandleObject obj, ObjOperandId objId, HandleId id); + bool tryAttachUnboxedExpando(HandleObject obj, ObjOperandId objId, HandleId id); + bool tryAttachTypedObject(HandleObject obj, ObjOperandId objId, HandleId id); + bool tryAttachObjectLength(HandleObject obj, ObjOperandId objId, HandleId id); + bool tryAttachModuleNamespace(HandleObject obj, ObjOperandId objId, HandleId id); + bool tryAttachWindowProxy(HandleObject obj, ObjOperandId objId, HandleId id); - bool tryAttachGenericProxy(HandleObject obj, ObjOperandId objId); - bool tryAttachDOMProxyShadowed(HandleObject obj, ObjOperandId objId); - bool tryAttachDOMProxyUnshadowed(HandleObject obj, ObjOperandId objId); - bool tryAttachProxy(HandleObject obj, ObjOperandId objId); + bool tryAttachGenericProxy(HandleObject obj, ObjOperandId objId, HandleId id); + bool tryAttachDOMProxyShadowed(HandleObject obj, ObjOperandId objId, HandleId id); + bool tryAttachDOMProxyUnshadowed(HandleObject obj, ObjOperandId objId, HandleId id); + bool tryAttachProxy(HandleObject obj, ObjOperandId objId, HandleId id); - bool tryAttachPrimitive(ValOperandId valId); - bool tryAttachStringLength(ValOperandId valId); - bool tryAttachMagicArguments(ValOperandId valId); + bool tryAttachPrimitive(ValOperandId valId, HandleId id); + bool tryAttachStringLength(ValOperandId valId, HandleId id); + bool tryAttachMagicArguments(ValOperandId valId, HandleId id); GetPropIRGenerator(const GetPropIRGenerator&) = delete; GetPropIRGenerator& operator=(const GetPropIRGenerator&) = delete; @@ -592,7 +592,7 @@ class MOZ_RAII GetPropIRGenerator public: GetPropIRGenerator(JSContext* cx, jsbytecode* pc, ICStubEngine engine, bool* isTemporarilyUnoptimizable, - HandleValue val, HandlePropertyName name, MutableHandleValue res); + HandleValue val, HandleValue idVal, MutableHandleValue res); bool tryAttachStub(); diff --git a/js/src/jit/SharedIC.cpp b/js/src/jit/SharedIC.cpp index e44bf9285c5a..3f4a72f9f8ff 100644 --- a/js/src/jit/SharedIC.cpp +++ b/js/src/jit/SharedIC.cpp @@ -2281,7 +2281,7 @@ UpdateExistingGetPropCallStubs(ICFallbackStub* fallbackStub, } bool -CheckHasNoSuchProperty(JSContext* cx, JSObject* obj, PropertyName* name, +CheckHasNoSuchProperty(JSContext* cx, JSObject* obj, jsid id, JSObject** lastProto, size_t* protoChainDepthOut) { size_t depth = 0; @@ -2289,9 +2289,9 @@ CheckHasNoSuchProperty(JSContext* cx, JSObject* obj, PropertyName* name, while (curObj) { if (curObj->isNative()) { // Don't handle proto chains with resolve hooks. - if (ClassMayResolveId(cx->names(), curObj->getClass(), NameToId(name), curObj)) + if (ClassMayResolveId(cx->names(), curObj->getClass(), id, curObj)) return false; - if (curObj->as().contains(cx, NameToId(name))) + if (curObj->as().contains(cx, id)) return false; if (curObj->getClass()->getGetProperty()) return false; @@ -2299,13 +2299,13 @@ CheckHasNoSuchProperty(JSContext* cx, JSObject* obj, PropertyName* name, // Non-native objects are only handled as the original receiver. return false; } else if (curObj->is()) { - if (curObj->as().containsUnboxedOrExpandoProperty(cx, NameToId(name))) + if (curObj->as().containsUnboxedOrExpandoProperty(cx, id)) return false; } else if (curObj->is()) { - if (name == cx->names().length) + if (JSID_IS_ATOM(id, cx->names().length)) return false; } else if (curObj->is()) { - if (curObj->as().typeDescr().hasProperty(cx->names(), NameToId(name))) + if (curObj->as().typeDescr().hasProperty(cx->names(), id)) return false; } else { return false; @@ -2404,7 +2404,8 @@ DoGetPropFallback(JSContext* cx, void* payload, ICGetProp_Fallback* stub_, } if (!attached && !JitOptions.disableCacheIR) { - GetPropIRGenerator gen(cx, pc, engine, &isTemporarilyUnoptimizable, val, name, res); + RootedValue idVal(cx, StringValue(name)); + GetPropIRGenerator gen(cx, pc, engine, &isTemporarilyUnoptimizable, val, idVal, res); if (gen.tryAttachStub()) { ICStub* newStub = AttachBaselineCacheIRStub(cx, gen.writerRef(), CacheKind::GetProp, engine, info.outerScript(cx), stub); diff --git a/js/src/jit/SharedIC.h b/js/src/jit/SharedIC.h index 5a0fe2fcffbd..6eddf67562c7 100644 --- a/js/src/jit/SharedIC.h +++ b/js/src/jit/SharedIC.h @@ -2238,7 +2238,7 @@ UpdateExistingGetPropCallStubs(ICFallbackStub* fallbackStub, HandleObject receiver, HandleFunction getter); MOZ_MUST_USE bool -CheckHasNoSuchProperty(JSContext* cx, JSObject* obj, PropertyName* name, +CheckHasNoSuchProperty(JSContext* cx, JSObject* obj, jsid id, JSObject** lastProto = nullptr, size_t* protoChainDepthOut = nullptr); void