Bug 1133565: Factor SIMD templates within a compartment; r=jandem,jonco

--HG--
extra : rebase_source : 64c185723ef23fce6fe8f8e7569738eaa3526fdf

js/src/builtin/TypedObject.h

@@ -333,7 +333,8 @@ class SimdTypeDescr : public ComplexTypeDescr
     enum Type {
         TYPE_INT32 = JS_SIMDTYPEREPR_INT32,
         TYPE_FLOAT32 = JS_SIMDTYPEREPR_FLOAT32,
-        TYPE_FLOAT64 = JS_SIMDTYPEREPR_FLOAT64
+        TYPE_FLOAT64 = JS_SIMDTYPEREPR_FLOAT64,
+        LAST_TYPE = TYPE_FLOAT64
     };
 
     static const type::Kind Kind = type::Simd;

js/src/jit/BaselineIC.cpp

@@ -9167,17 +9167,13 @@ GetTemplateObjectForNative(JSContext *cx, HandleScript script, jsbytecode *pc,
     if (native == js_String) {
         RootedString emptyString(cx, cx->runtime()->emptyString);
         res.set(StringObject::create(cx, emptyString, TenuredObject));
-        if (!res)
+        return !!res;
-            return false;
-        return true;
     }
 
     if (native == obj_create && args.length() == 1 && args[0].isObjectOrNull()) {
         RootedObject proto(cx, args[0].toObjectOrNull());
         res.set(ObjectCreateImpl(cx, proto, TenuredObject));
-        if (!res)
+        return !!res;
-            return false;
-        return true;
     }
 
     if (JitSupportsSimd()) {
@@ -9186,11 +9182,9 @@ GetTemplateObjectForNative(JSContext *cx, HandleScript script, jsbytecode *pc,
            ARITH_COMMONX4_SIMD_OP(ADD_INT32X4_SIMD_OP_NAME_)
            BITWISE_COMMONX4_SIMD_OP(ADD_INT32X4_SIMD_OP_NAME_))
        {
-            Rooted<TypeDescr *> descr(cx, &Int32x4::GetTypeDescr(*cx->global()));
+            Rooted<SimdTypeDescr *> descr(cx, &cx->global()->int32x4TypeDescr().as<SimdTypeDescr>());
-            res.set(TypedObject::createZeroed(cx, descr, 0, gc::TenuredHeap));
+            res.set(cx->compartment()->jitCompartment()->getSimdTemplateObjectFor(cx, descr));
-            if (!res)
+            return !!res;
-                return false;
-            return true;
        }
 #undef ADD_INT32X4_SIMD_OP_NAME_
     }
@@ -9204,20 +9198,14 @@ GetTemplateObjectForClassHook(JSContext *cx, JSNative hook, CallArgs &args,
 {
     if (hook == TypedObject::construct) {
         Rooted<TypeDescr *> descr(cx, &args.callee().as<TypeDescr>());
-        JSObject *obj = TypedObject::createZeroed(cx, descr, 1, gc::TenuredHeap);
+        templateObject.set(TypedObject::createZeroed(cx, descr, 1, gc::TenuredHeap));
-        if (!obj)
+        return !!templateObject;
-            return false;
-        templateObject.set(obj);
-        return true;
     }
 
     if (hook == SimdTypeDescr::call && JitSupportsSimd()) {
         Rooted<SimdTypeDescr *> descr(cx, &args.callee().as<SimdTypeDescr>());
-        JSObject *obj = TypedObject::createZeroed(cx, descr, 0, gc::TenuredHeap);
+        templateObject.set(cx->compartment()->jitCompartment()->getSimdTemplateObjectFor(cx, descr));
-        if (!obj)
+        return !!templateObject;
-            return false;
-        templateObject.set(obj);
-        return true;
     }
 
     return true;

js/src/jit/Ion.cpp

@@ -533,6 +533,12 @@ JitCompartment::sweep(FreeOp *fop, JSCompartment *compartment)
 
     if (regExpTestStub_ && !IsJitCodeMarked(&regExpTestStub_))
         regExpTestStub_ = nullptr;
+
+    for (size_t i = 0; i <= SimdTypeDescr::LAST_TYPE; i++) {
+        ReadBarrieredObject &obj = simdTemplateObjects_[i];
+        if (obj && IsObjectAboutToBeFinalized(obj.unsafeGet()))
+            obj.set(nullptr);
+    }
 }
 
 void

js/src/jit/JitCompartment.h

@@ -7,10 +7,12 @@
 #ifndef jit_JitCompartment_h
 #define jit_JitCompartment_h
 
+#include "mozilla/Array.h"
 #include "mozilla/MemoryReporting.h"
 
 #include "jsweakcache.h"
 
+#include "builtin/TypedObject.h"
 #include "jit/CompileInfo.h"
 #include "jit/IonCode.h"
 #include "jit/JitFrames.h"
@@ -433,11 +435,19 @@ class JitCompartment
     JitCode *regExpExecStub_;
     JitCode *regExpTestStub_;
 
+    mozilla::Array<ReadBarrieredObject, SimdTypeDescr::LAST_TYPE + 1> simdTemplateObjects_;
+
     JitCode *generateStringConcatStub(JSContext *cx);
     JitCode *generateRegExpExecStub(JSContext *cx);
     JitCode *generateRegExpTestStub(JSContext *cx);
 
   public:
+    JSObject *getSimdTemplateObjectFor(JSContext *cx, Handle<SimdTypeDescr*> descr) {
+        ReadBarrieredObject &tpl = simdTemplateObjects_[descr->type()];
+        if (!tpl)
+            tpl.set(TypedObject::createZeroed(cx, descr, 0, gc::TenuredHeap));
+        return tpl.get();
+    }
     JitCode *getStubCode(uint32_t key) {
         ICStubCodeMap::AddPtr p = stubCodes_->lookupForAdd(key);
         if (p)

js/src/jit/MIR.h

@@ -3012,8 +3012,6 @@ class MSimdBox
     bool congruentTo(const MDefinition *ins) const MOZ_OVERRIDE {
         if (congruentIfOperandsEqual(ins)) {
             MOZ_ASSERT(ins->toSimdBox()->initialHeap() == initialHeap());
-            // The template object is likely to be different, but represents the
-            // same kind of objects as the MIRTypes are identical.
             return true;
         }