Methods only need to be created as extended functions when they need to store
their home-object. So any method which doesn't use `super` can actually be
created as a normal, non-extended function.
Depends on D142932
Differential Revision: https://phabricator.services.mozilla.com/D142933
Private instance accessors were always initialising the home object, even when
`needsHomeObject()` was `false`.
Depends on D142931
Differential Revision: https://phabricator.services.mozilla.com/D142932
Change `emitPrivateMethodInitializer()` to accept a `ClassMethod*` instead of
receiving the separate child parse nodes of `ClassMethod`.
Drive-by change:
- Use less casts.
- Remove unreachable `PrivateNameKind::Method` case from switch.
Depends on D142930
Differential Revision: https://phabricator.services.mozilla.com/D142931
The FunctionBox is created with the exact same FunctionFlags, so we don't have
to pass the flags as a separate parameter, but instead can read them from the
`FunctionBox::flags_` member.
Depends on D142929
Differential Revision: https://phabricator.services.mozilla.com/D142930
We can simplify the code a bit now that RHS is usually a register instead of a
constant.
A constant object can still show up for inlined `isPrototypeOf`, because that uses
the same CacheIR/MIR instruction, but this is uncommon (shows up on one jit-test
with `--ion`).
Depends on D143022
Differential Revision: https://phabricator.services.mozilla.com/D143023
We used to rely on knowing the specific `.prototype` object in `BaselineInspector`,
but now that we no longer do that there's no value in guarding on a specific object
here. By supporting any object we can handle polymorphism better.
Differential Revision: https://phabricator.services.mozilla.com/D143022
We can use the output register as an additional temp register for
`branchTestObjectEmulatesUndefined()`.
Depends on D142957
Differential Revision: https://phabricator.services.mozilla.com/D142958
`EmulateStateOf<T>::run` uses `MNodeIterator` to iterate over the instructions in a block. `MNodeIterator` has some internal cleverness to visit the resume point attached to an instruction, unless that instruction has been discarded. In `visitApplyArray`, we steal the resume point from the applyArray, attach it to a new call, and discard the applyArray. Because the applyArray was discarded, MNodeIterator skips the resume point. We don't update the list of stores, so the recovery code allocates an empty array instead of an initialized array, causing us to get the wrong answer if we invalidate due to GC inside the replaced spread call.
This patch changes MNodeIterator to store the resume point instead of the instruction, which simplifies the code somewhat and seems more robust.
Differential Revision: https://phabricator.services.mozilla.com/D142579
Using defineReuseInput in LIRGenerator to prevents rhs == output && lhs != output,
which is the case that would clobber the rhs in copySignDouble().
Differential Revision: https://phabricator.services.mozilla.com/D142994
Following Clang11, encode a 0.0 as MOVI and a -0.0 as MOVI+FNEG. This
avoids gpr->fpr moves and loads from memory everywhere and probably
insulates us a little from microarchitectural differences.
Differential Revision: https://phabricator.services.mozilla.com/D143018
Add `ArgumentsObject::isElement()` so we can make `isElementDeleted()` a
private method to avoid repeating the same kind of bug in the future.
Differential Revision: https://phabricator.services.mozilla.com/D142667
`UnmappedArgumentsObject` doesn't mark an element as deleted when it is
redefined through `Object.defineProperty()`, that means the current element
value can only be read through `ArgumentsObject::element()` when the
`ELEMENT_OVERRIDDEN_BIT` isn't set.
Alternatively to this patch, we could also add a `ObjectOps::defineProperty`
hook for `UnmappedArgumentsObject` to properly update the element value instead
of redefining the property. But reassigning argument elements should be
relatively uncommon, so it should be fine to just always take the slow-path
when `ELEMENT_OVERRIDDEN_BIT` is set.
The tests in "bug1762575-1.js" work on mapped arguments objects and already
pass without this patch. "bug1762575-2.js" uses mapped arguments objects and
only passes with this patch. "bug1762575-3.js" tests some implementation
details when arguments object keep a strong reference to their elements.
Differential Revision: https://phabricator.services.mozilla.com/D142666
`compare->isNumericComparison()` is already checked at the start of the loop,
so we don't have to check for it another time when handling strict equality
operators.
Depends on D142927
Differential Revision: https://phabricator.services.mozilla.com/D142928
Remove local decisions about how to load FP constants and centralize
that knowledge in loadConstantDouble / loadConstantFloat32. Code that
needs to load eg -0.0 can just pass that value to those functions and
expect optimal code.
Note in those functions that the optimal way of loading negative zero
is to load it PC-relative from memory, not to construct it with a
multi-instruction sequence.
Differential Revision: https://phabricator.services.mozilla.com/D142917
Pass through the number of formals, so we know how many initial arguments we have to skip
in `CodeGenerator::emitPushArguments()`. The actual number of arguments (`argc`) for
`M(Apply|Construct)Args` is computed through `Math.max(numActuals - numFormals, 0)`.
Differential Revision: https://phabricator.services.mozilla.com/D142848
Butkovits Atila
André Bargull
Nicolò Ribaudo
Jan de Mooij
Iain Ireland
Yury Delendik
Frederik Braun
Lars T Hansen
Gerald Squelart
Noemi Erli
Steve Fink
Jan Rio Krause