Bug 905999 - Part 2: Store cache location data in IonScript for runtime lookup. (r=nbp)

js/src/jit/CodeGenerator.cpp

@@ -5928,6 +5928,14 @@ bool
 CodeGenerator::visitGetPropertyIC(OutOfLineUpdateCache *ool, DataPtr<GetPropertyIC> &ic)
 {
     LInstruction *lir = ool->lir();
+
+    if (ic->idempotent()) {
+        size_t numLocs;
+        CacheLocationList &cacheLocs = lir->mirRaw()->toGetPropertyCache()->location();
+        size_t locationBase = addCacheLocations(cacheLocs, &numLocs);
+        ic->setLocationInfo(locationBase, numLocs);
+    }
+
     saveLive(lir);
 
     pushArg(ic->object());

js/src/jit/IonCaches.h

@@ -499,6 +499,24 @@ class DispatchIonCache : public IonCache
 // Subclasses of IonCache for the various kinds of caches. These do not define
 // new data members; all caches must be of the same size.
 
+// Helper for idempotent GetPropertyIC location tracking. Declared externally
+// to be forward declarable.
+//
+// Since all the scripts stored in CacheLocations are guaranteed to have been
+// Ion compiled, and are kept alive by function objects in jitcode, and since
+// the CacheLocations only have the lifespan of the jitcode, there is no need
+// to trace or mark any of the scripts. Since JSScripts are always allocated
+// tenured, and never moved, we can keep raw pointers, and there is no need
+// for HeapPtrScripts here.
+struct CacheLocation {
+    jsbytecode *pc;
+    JSScript *script;
+
+    CacheLocation(jsbytecode *pcin, JSScript *scriptin)
+        : pc(pcin), script(scriptin)
+    { }
+};
+
 class GetPropertyIC : public RepatchIonCache
 {
   protected:
@@ -509,6 +527,11 @@ class GetPropertyIC : public RepatchIonCache
     Register object_;
     PropertyName *name_;
     TypedOrValueRegister output_;
+
+    // Only valid if idempotent
+    size_t locationsIndex_;
+    size_t numLocations_;
+
     bool allowGetters_ : 1;
     bool hasTypedArrayLengthStub_ : 1;
     bool hasStrictArgumentsLengthStub_ : 1;
@@ -524,6 +547,8 @@ class GetPropertyIC : public RepatchIonCache
         object_(object),
         name_(name),
         output_(output),
+        locationsIndex_(0),
+        numLocations_(0),
         allowGetters_(allowGetters),
         hasTypedArrayLengthStub_(false),
         hasStrictArgumentsLengthStub_(false),
@@ -558,6 +583,14 @@ class GetPropertyIC : public RepatchIonCache
         return hasGenericProxyStub_;
     }
 
+    void setLocationInfo(size_t locationsIndex, size_t numLocations) {
+        JS_ASSERT(idempotent());
+        JS_ASSERT(!numLocations_);
+        JS_ASSERT(numLocations);
+        locationsIndex_ = locationsIndex;
+        numLocations_ = numLocations;
+    }
+
     enum NativeGetPropCacheability {
         CanAttachError,
         CanAttachNone,

js/src/jit/IonCode.h

@@ -148,6 +148,7 @@ class SafepointIndex;
 class OsiIndex;
 class IonCache;
 struct PatchableBackedgeInfo;
+struct CacheLocation;
 
 // Describes a single AsmJSModule which jumps (via an FFI exit with the given
 // index) directly into an IonScript.
@@ -496,6 +497,10 @@ struct IonScript
     size_t runtimeSize() const {
         return runtimeSize_;
     }
+    CacheLocation *getCacheLocs(uint32_t locIndex) {
+        JS_ASSERT(locIndex < runtimeSize_);
+        return (CacheLocation *) &runtimeData()[locIndex];
+    }
     void toggleBarriers(bool enabled);
     void purgeCaches(JS::Zone *zone);
     void destroyCaches();

js/src/jit/shared/CodeGenerator-shared.cpp

@@ -903,5 +903,22 @@ CodeGeneratorShared::jumpToBlock(MBasicBlock *mir, Assembler::Condition cond)
     }
 }
 
+size_t
+CodeGeneratorShared::addCacheLocations(const CacheLocationList &locs, size_t *numLocs)
+{
+    size_t firstIndex = runtimeData_.length();
+    size_t numLocations = 0;
+    for (CacheLocationList::iterator iter = locs.begin(); iter != locs.end(); iter++) {
+        // allocateData() ensures that sizeof(CacheLocation) is word-aligned.
+        // If this changes, we will need to pad to ensure alignment.
+        size_t curIndex = allocateData(sizeof(CacheLocation));
+        new (&runtimeData_[curIndex]) CacheLocation(iter->pc, iter->script);
+        numLocations++;
+    }
+    JS_ASSERT(numLocations != 0);
+    *numLocs = numLocations;
+    return firstIndex;
+}
+
 } // namespace jit
 } // namespace js

js/src/jit/shared/CodeGenerator-shared.h

@@ -382,6 +382,7 @@ class CodeGeneratorShared : public LInstructionVisitor
     }
 
     bool addCache(LInstruction *lir, size_t cacheIndex);
+    size_t addCacheLocations(const CacheLocationList &locs, size_t *numLocs);
 
   protected:
     bool addOutOfLineCode(OutOfLineCode *code);