Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-02 01:48:05 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1041688 - Don't use a JSContext in IonBuilder when performing the definite properties analysis, r=jandem.

Browse Source
This commit is contained in:
Brian Hackett 2014-09-11 09:12:31 -06:00
parent 6112a6a45c
commit c9d8b49279
9 changed files with 17 additions and 77 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
js/src/jit/Ion.cpp
View File

@ -2034,8 +2034,7 @@ IonCompile(JSContext *cx, JSScript *script,
const OptimizationInfo *optimizationInfo = js_IonOptimizations.get(optimizationLevel);
const JitCompileOptions options(cx);
IonBuilder *builder = alloc->new_<IonBuilder>((JSContext *) nullptr,
CompileCompartment::get(cx->compartment()),
IonBuilder *builder = alloc->new_<IonBuilder>(CompileCompartment::get(cx->compartment()),
options, temp, graph, constraints,
inspector, info, optimizationInfo,
baselineFrameInspector);

4
js/src/jit/IonAnalysis.cpp
View File

@ -2792,7 +2792,7 @@ jit::AnalyzeNewScriptDefiniteProperties(JSContext *cx, JSFunction *fun,
BaselineInspector inspector(script);
const JitCompileOptions options(cx);
IonBuilder builder(cx, CompileCompartment::get(cx->compartment()), options, &temp, &graph, constraints,
IonBuilder builder(CompileCompartment::get(cx->compartment()), options, &temp, &graph, constraints,
&inspector, &info, optimizationInfo, /* baselineFrame = */ nullptr);
if (!builder.build()) {
@ -3019,7 +3019,7 @@ jit::AnalyzeArgumentsUsage(JSContext *cx, JSScript *scriptArg)
BaselineInspector inspector(script);
const JitCompileOptions options(cx);
IonBuilder builder(nullptr, CompileCompartment::get(cx->compartment()), options, &temp, &graph, constraints,
IonBuilder builder(CompileCompartment::get(cx->compartment()), options, &temp, &graph, constraints,
&inspector, &info, optimizationInfo, /* baselineFrame = */ nullptr);
if (!builder.build()) {

49
js/src/jit/IonBuilder.cpp
View File

@ -106,7 +106,7 @@ jit::NewBaselineFrameInspector(TempAllocator *temp, BaselineFrame *frame, Compil
return inspector;
}
IonBuilder::IonBuilder(JSContext *analysisContext, CompileCompartment *comp,
IonBuilder::IonBuilder(CompileCompartment *comp,
const JitCompileOptions &options, TempAllocator *temp,
MIRGraph *graph, types::CompilerConstraintList *constraints,
BaselineInspector *inspector, CompileInfo *info,
@ -115,7 +115,6 @@ IonBuilder::IonBuilder(JSContext *analysisContext, CompileCompartment *comp,
uint32_t loopDepth)
: MIRGenerator(comp, options, temp, graph, info, optimizationInfo),
backgroundCodegen_(nullptr),
analysisContext(analysisContext),
baselineFrame_(baselineFrame),
constraints_(constraints),
analysis_(*temp, info->script()),
@ -147,7 +146,6 @@ IonBuilder::IonBuilder(JSContext *analysisContext, CompileCompartment *comp,
abortReason_ = AbortReason_Disable;
JS_ASSERT(script()->hasBaselineScript() == (info->executionMode() != ArgumentsUsageAnalysis));
JS_ASSERT(!!analysisContext == (info->executionMode() == DefinitePropertiesAnalysis));
if (!info->executionModeIsAnalysis())
script()->baselineScript()->setIonCompiledOrInlined();
@ -156,7 +154,6 @@ IonBuilder::IonBuilder(JSContext *analysisContext, CompileCompartment *comp,
void
IonBuilder::clearForBackEnd()
{
JS_ASSERT(!analysisContext);
baselineFrame_ = nullptr;
// The caches below allocate data from the malloc heap. Release this before
@ -349,22 +346,6 @@ IonBuilder::canInlineTarget(JSFunction *target, CallInfo &callInfo)
if (!target->isInterpreted())
return DontInline(nullptr, "Non-interpreted target");
// Allow constructing lazy scripts when performing the definite properties
// analysis, as baseline has not been used to warm the caller up yet.
if (target->isInterpreted() && info().executionMode() == DefinitePropertiesAnalysis) {
RootedScript script(analysisContext, target->getOrCreateScript(analysisContext));
if (!script)
return InliningDecision_Error;
if (!script->hasBaselineScript() && script->canBaselineCompile()) {
MethodStatus status = BaselineCompile(analysisContext, script);
if (status == Method_Error)
return InliningDecision_Error;
if (status != Method_Compiled)
return InliningDecision_DontInline;
}
}
if (!target->hasScript())
return DontInline(nullptr, "Lazy script");
@ -4203,16 +4184,10 @@ IonBuilder::inlineScriptedCall(CallInfo &callInfo, JSFunction *target)
AutoAccumulateReturns aar(graph(), returns);
// Build the graph.
IonBuilder inlineBuilder(analysisContext, compartment, options, &alloc(), &graph(), constraints(),
IonBuilder inlineBuilder(compartment, options, &alloc(), &graph(), constraints(),
&inspector, info, &optimizationInfo(), nullptr, inliningDepth_ + 1,
loopDepth_);
if (!inlineBuilder.buildInline(this, outerResumePoint, callInfo)) {
if (analysisContext && analysisContext->isExceptionPending()) {
JitSpew(JitSpew_Abort, "Inline builder raised exception.");
abortReason_ = AbortReason_Error;
return false;
}
// Inlining the callee failed. Mark the callee as uninlineable only if
// the inlining was aborted for a non-exception reason.
if (inlineBuilder.abortReason_ == AbortReason_Disable) {
@ -6411,8 +6386,6 @@ IonBuilder::testSingletonProperty(JSObject *obj, PropertyName *name)
return nullptr;
types::TypeObjectKey *objType = types::TypeObjectKey::get(obj);
if (analysisContext)
objType->ensureTrackedProperty(analysisContext, NameToId(name));
if (objType->unknownProperties())
return nullptr;
@ -6494,8 +6467,6 @@ IonBuilder::testSingletonPropertyTypes(MDefinition *obj, JSObject *singleton, Pr
types::TypeObjectKey *object = types->getObject(i);
if (!object)
continue;
if (analysisContext)
object->ensureTrackedProperty(analysisContext, NameToId(name));
const Class *clasp = object->clasp();
if (!ClassHasEffectlessLookup(clasp, name) || ClassHasResolveHook(compartment, clasp, name))
@ -6703,8 +6674,6 @@ IonBuilder::getStaticName(JSObject *staticObject, PropertyName *name, bool *psuc
}
types::TypeObjectKey *staticType = types::TypeObjectKey::get(staticObject);
if (analysisContext)
staticType->ensureTrackedProperty(analysisContext, NameToId(name));
if (staticType->unknownProperties()) {
*psucceeded = false;
@ -6723,7 +6692,7 @@ IonBuilder::getStaticName(JSObject *staticObject, PropertyName *name, bool *psuc
}
types::TemporaryTypeSet *types = bytecodeTypes(pc);
BarrierKind barrier = PropertyReadNeedsTypeBarrier(analysisContext, constraints(), staticType,
BarrierKind barrier = PropertyReadNeedsTypeBarrier(constraints(), staticType,
name, types, /* updateObserved = */ true);
JSObject *singleton = types->getSingleton();
@ -7539,8 +7508,7 @@ IonBuilder::getElemTryCache(bool *emitted, MDefinition *obj, MDefinition *index)
// Emit GetElementCache.
types::TemporaryTypeSet *types = bytecodeTypes(pc);
BarrierKind barrier = PropertyReadNeedsTypeBarrier(analysisContext, constraints(), obj,
nullptr, types);
BarrierKind barrier = PropertyReadNeedsTypeBarrier(constraints(), obj, nullptr, types);
// Always add a barrier if the index might be a string or symbol, so that
// the cache can attach stubs for particular properties.
@ -7588,8 +7556,7 @@ IonBuilder::jsop_getelem_dense(MDefinition *obj, MDefinition *index)
AddObjectsForPropertyRead(obj, nullptr, types);
}
BarrierKind barrier = PropertyReadNeedsTypeBarrier(analysisContext, constraints(), obj,
nullptr, types);
BarrierKind barrier = PropertyReadNeedsTypeBarrier(constraints(), obj, nullptr, types);
bool needsHoleCheck = !ElementAccessIsPacked(constraints(), obj);
// Reads which are on holes in the object do not have to bail out if
@ -8905,8 +8872,7 @@ IonBuilder::jsop_getprop(PropertyName *name)
if (!getPropTryArgumentsCallee(&emitted, obj, name) || emitted)
return emitted;
BarrierKind barrier = PropertyReadNeedsTypeBarrier(analysisContext, constraints(),
obj, name, types);
BarrierKind barrier = PropertyReadNeedsTypeBarrier(constraints(), obj, name, types);
// Always use a call if we are performing analysis and
// not actually emitting code, to simplify later analysis. Also skip deeper
@ -9588,8 +9554,7 @@ IonBuilder::getPropTryInnerize(bool *emitted, MDefinition *obj, PropertyName *na
// Passing the inner object to GetProperty IC is safe, see the
// needsOuterizedThisObject check in IsCacheableGetPropCallNative.
BarrierKind barrier = PropertyReadNeedsTypeBarrier(analysisContext, constraints(),
inner, name, types);
BarrierKind barrier = PropertyReadNeedsTypeBarrier(constraints(), inner, name, types);
if (!getPropTryCache(emitted, inner, name, barrier, types) || *emitted)
return *emitted;

3
js/src/jit/IonBuilder.h
View File

@ -214,7 +214,7 @@ class IonBuilder
static int CmpSuccessors(const void *a, const void *b);
public:
IonBuilder(JSContext *analysisContext, CompileCompartment *comp,
IonBuilder(CompileCompartment *comp,
const JitCompileOptions &options, TempAllocator *temp,
MIRGraph *graph, types::CompilerConstraintList *constraints,
BaselineInspector *inspector, CompileInfo *info,
@ -865,7 +865,6 @@ class IonBuilder
private:
bool init();
JSContext *analysisContext;
BaselineFrameInspector *baselineFrame_;
// Constraints for recording dependencies on type information.

3
js/src/jit/MCallOptimize.cpp
View File

@ -433,8 +433,7 @@ IonBuilder::inlineArrayPopShift(CallInfo &callInfo, MArrayPopShift::Mode mode)
bool needsHoleCheck = thisTypes->hasObjectFlags(constraints(), types::OBJECT_FLAG_NON_PACKED);
bool maybeUndefined = returnTypes->hasType(types::Type::UndefinedType());
BarrierKind barrier = PropertyReadNeedsTypeBarrier(analysisContext, constraints(),
obj, nullptr, returnTypes);
BarrierKind barrier = PropertyReadNeedsTypeBarrier(constraints(), obj, nullptr, returnTypes);
if (barrier != BarrierKind::NoBarrier)
returnType = MIRType_Value;

10
js/src/jit/MIR.cpp
View File

@ -3667,8 +3667,7 @@ PropertyReadNeedsTypeBarrier(types::CompilerConstraintList *constraints,
}
BarrierKind
jit::PropertyReadNeedsTypeBarrier(JSContext *propertycx,
types::CompilerConstraintList *constraints,
jit::PropertyReadNeedsTypeBarrier(types::CompilerConstraintList *constraints,
types::TypeObjectKey *object, PropertyName *name,
types::TemporaryTypeSet *observed, bool updateObserved)
{
@ -3688,8 +3687,6 @@ jit::PropertyReadNeedsTypeBarrier(JSContext *propertycx,
break;
types::TypeObjectKey *typeObj = types::TypeObjectKey::get(obj);
if (propertycx)
typeObj->ensureTrackedProperty(propertycx, NameToId(name));
if (!typeObj->unknownProperties()) {
types::HeapTypeSetKey property = typeObj->property(NameToId(name));
@ -3715,8 +3712,7 @@ jit::PropertyReadNeedsTypeBarrier(JSContext *propertycx,
}
BarrierKind
jit::PropertyReadNeedsTypeBarrier(JSContext *propertycx,
types::CompilerConstraintList *constraints,
jit::PropertyReadNeedsTypeBarrier(types::CompilerConstraintList *constraints,
MDefinition *obj, PropertyName *name,
types::TemporaryTypeSet *observed)
{
@ -3733,7 +3729,7 @@ jit::PropertyReadNeedsTypeBarrier(JSContext *propertycx,
for (size_t i = 0; i < types->getObjectCount(); i++) {
types::TypeObjectKey *object = types->getObject(i);
if (object) {
BarrierKind kind = PropertyReadNeedsTypeBarrier(propertycx, constraints, object, name,
BarrierKind kind = PropertyReadNeedsTypeBarrier(constraints, object, name,
observed, updateObserved);
if (kind == BarrierKind::TypeSet)
return BarrierKind::TypeSet;

6
js/src/jit/MIR.h
View File

@ -11757,12 +11757,10 @@ bool ElementAccessMightBeCopyOnWrite(types::CompilerConstraintList *constraints,
bool ElementAccessHasExtraIndexedProperty(types::CompilerConstraintList *constraints,
MDefinition *obj);
MIRType DenseNativeElementType(types::CompilerConstraintList *constraints, MDefinition *obj);
BarrierKind PropertyReadNeedsTypeBarrier(JSContext *propertycx,
types::CompilerConstraintList *constraints,
BarrierKind PropertyReadNeedsTypeBarrier(types::CompilerConstraintList *constraints,
types::TypeObjectKey *object, PropertyName *name,
types::TemporaryTypeSet *observed, bool updateObserved);
BarrierKind PropertyReadNeedsTypeBarrier(JSContext *propertycx,
types::CompilerConstraintList *constraints,
BarrierKind PropertyReadNeedsTypeBarrier(types::CompilerConstraintList *constraints,
MDefinition *obj, PropertyName *name,
types::TemporaryTypeSet *observed);
BarrierKind PropertyReadOnPrototypeNeedsTypeBarrier(types::CompilerConstraintList *constraints,

15
js/src/jsinfer.cpp
View File

@ -1091,21 +1091,6 @@ TypeObjectKey::property(jsid id)
return property;
}
void
TypeObjectKey::ensureTrackedProperty(JSContext *cx, jsid id)
{
// If we are accessing a lazily defined property which actually exists in
// the VM and has not been instantiated yet, instantiate it now if we are
// on the main thread and able to do so.
if (!JSID_IS_VOID(id) && !JSID_IS_EMPTY(id)) {
JS_ASSERT(CurrentThreadCanAccessRuntime(cx->runtime()));
if (JSObject *obj = singleton()) {
if (obj->isNative() && obj->nativeLookupPure(id))
EnsureTrackPropertyTypes(cx, obj, id);
}
}
}
bool
HeapTypeSetKey::instantiate(JSContext *cx)
{

1
js/src/jsinfer.h
View File

@ -1465,7 +1465,6 @@ struct TypeObjectKey
void watchStateChangeForInlinedCall(CompilerConstraintList *constraints);
void watchStateChangeForTypedArrayData(CompilerConstraintList *constraints);
HeapTypeSetKey property(jsid id);
void ensureTrackedProperty(JSContext *cx, jsid id);
TypeObject *maybeType();
};