Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-09 03:15:11 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1073991 - Don't change types in JIT caches when the type's newScript has been cleared, r=jandem.

Browse Source
This commit is contained in:
Brian Hackett 2014-09-30 20:35:37 -07:00
parent a7457c180c
commit fc6ee6630d
3 changed files with 37 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
js/src/jit/BaselineIC.cpp
View File

@ -7911,13 +7911,28 @@ ICSetPropNativeAddCompiler::generateStubCode(MacroAssembler &masm)
masm.loadPtr(Address(BaselineStubReg, ICSetProp_NativeAdd::offsetOfNewShape()), scratch);
masm.storePtr(scratch, shapeAddr);
// Change the object's type if required.
// Try to change the object's type.
Label noTypeChange;
// Check if the cache has a new type to change to.
masm.loadPtr(Address(BaselineStubReg, ICSetProp_NativeAdd::offsetOfNewType()), scratch);
masm.branchTestPtr(Assembler::Zero, scratch, scratch, &noTypeChange);
// Check if the old type still has a newScript.
masm.loadPtr(Address(objReg, JSObject::offsetOfType()), scratch);
masm.branchPtr(Assembler::Equal,
Address(scratch, types::TypeObject::offsetOfNewScript()),
ImmWord(0),
&noTypeChange);
// Reload the new type from the cache.
masm.loadPtr(Address(BaselineStubReg, ICSetProp_NativeAdd::offsetOfNewType()), scratch);
// Change the object's type.
Address typeAddr(objReg, JSObject::offsetOfType());
EmitPreBarrier(masm, typeAddr, MIRType_TypeObject);
masm.storePtr(scratch, typeAddr);
masm.bind(&noTypeChange);
Register holderReg;

18
js/src/jit/IonCaches.cpp
View File

@ -2583,11 +2583,27 @@ GenerateAddSlot(JSContext *cx, MacroAssembler &masm, IonCache::StubAttacher &att
if (oldType != obj->type()) {
// Changing object's type from a partially to fully initialized type,
// per the acquired properties analysis.
// per the acquired properties analysis. Only change the type if the
// old type still has a newScript.
Label noTypeChange, skipPop;
masm.push(object);
masm.loadPtr(Address(object, JSObject::offsetOfType()), object);
masm.branchPtr(Assembler::Equal,
Address(object, types::TypeObject::offsetOfNewScript()),
ImmWord(0),
&noTypeChange);
masm.pop(object);
Address typeAddr(object, JSObject::offsetOfType());
if (cx->zone()->needsIncrementalBarrier())
masm.callPreBarrier(typeAddr, MIRType_TypeObject);
masm.storePtr(ImmGCPtr(obj->type()), typeAddr);
masm.jump(&skipPop);
masm.bind(&noTypeChange);
masm.pop(object);
masm.bind(&skipPop);
}
// Set the value on the object. Since this is an add, obj->lastProperty()

4
js/src/jsinfer.h
View File

@ -1236,6 +1236,10 @@ struct TypeObject : public gc::TenuredCell
return offsetof(TypeObject, proto_);
}
static inline uint32_t offsetOfNewScript() {
return offsetof(TypeObject, newScript_);
}
private:
inline uint32_t basePropertyCount() const;
inline void setBasePropertyCount(uint32_t count);