This patch implements one half of support for multi-value returns in the
baseline compiler.
The idea is that when you have a function that has stack return values,
it will receive an additional synthetic argument: a pointer to the stack
results area. The layout of this area is the same as that understood by
BaseCompiler::pushBlockResults.
When compiling a function that has stack results, the stack result area
pointer will come in either in a register or on the stack. If it's on
the stack we record that offset and will load a pointer at that offset
when returning values. If the pointer is in a register, it gets spilled
to the stack after the spilled copies of previous register arguments.
When calling a function that has multiple return values, we bump the
stack pointer and pass an additional argument to the callee: the pointer
to that stack area. After the call, in the baseline compiler, it may be
that we need to shuffle any stack results down, because incoming
arguments are consumed by the call.
Note that support for actually returning multiple values is not yet
implemented in this patch; we're just adding infra. Also note that Ion
support isn't there yet either. However all tests pass, because no
FuncType that has more than one result gets past the validator.
Differential Revision: https://phabricator.services.mozilla.com/D56756
--HG--
extra : moz-landing-system : lando
Remove the test file because generator comprehensions have been removed a while ago.
Differential Revision: https://phabricator.services.mozilla.com/D56943
--HG--
extra : moz-landing-system : lando
The changes in "lib/mandelbrot-results.js" are too large for a normal diff, so this
change was split from part 21.
Differential Revision: https://phabricator.services.mozilla.com/D56949
--HG--
extra : moz-landing-system : lando
auto-regress/bug713209.js
- Replace `toSource` with `toString` on string value for `print` output.
baseline/bug1063878.js
- Replace `Math.toSource` with `String`, which is also a non-scripted function.
basic/bug1141154.js
debug/bug1353356.js
- Replace `Number.prototype.toSource` with `toString` when called on an Array object.
- Both calls ensure a TypeError is thrown for this test.
basic/bug728609.js
- Replace indirect `toSource` calls with explicit calls.
- (The test relied on calling `o.first.toSource` being called when `o.toSource` is called.)
gc/bug-1108007.js
- Replace `toSource` call on a string value with the direct result.
- Based on the stack in the bug report, calling `toSource` is not necessarily required for this test.
gc/bug-1439284.js
- Replace `Boolean.prototype.toSource` with `toString` when called on a String object.
- Both calls ensure a TypeError is thrown for this test.
ion/bug1348777.js
- Replace `toSource` with `toString` when testing polymorphic calls.
ion/bug847412.js
ion/bug913749.js
xdr/tagged-template-literals-2.js
- Replace `toSource` on the (global) object with `JSON.stringify` to emulate object traversal.
ion/inlining/TypedObject-ObjectIsTypeDescr-*.js
- Replace `toSource` on TypedObjects with a call to `equivalent`.
- This should ensure the tests are still valid, because `equivalent` is also calling `ObjectIsTypeDescr`,
which is the function under test here.
ion/scalar-replacement-bug1138693.js
- Also replace `toSource` with `equivalent` in this test, because similar to `toSource`, `equivalent`
is also performing a load from a reserved slot.
Depends on D56940
Differential Revision: https://phabricator.services.mozilla.com/D56941
--HG--
extra : moz-landing-system : lando
These changes handle the following three cases:
1. Regression tests for `toSource` functions.
- Added `skip-if` annotation.
2. Contains `toSource` (a few) conformance tests, but also additional conformance tests.
- Added `if`-statements to skip the `toSource` bits when `toSource` is not present.
3. Contains many `toSource` conformance tests.
- Split the file into two separate files (see asm.js/testBug1147144.js and asm.js/testSource.js).
Depends on D56939
Differential Revision: https://phabricator.services.mozilla.com/D56940
--HG--
rename : js/src/jit-test/tests/asm.js/testBug1147144.js => js/src/jit-test/tests/asm.js/testBug1147144-2.js
rename : js/src/jit-test/tests/asm.js/testSource.js => js/src/jit-test/tests/asm.js/testSource-2.js
extra : moz-landing-system : lando
- Calling `toSource` is equivalent to calling `toString` on function declarations.
- For function expressions, the result of `toString` must be enclosed in parentheses
to get the equivalent result when compared to `toSource`.
Depends on D56937
Differential Revision: https://phabricator.services.mozilla.com/D56939
--HG--
extra : moz-landing-system : lando
`assertDeepEq` allows to compare arrays with nested objects, which isn't possible with `arraysEqual`.
Depends on D56936
Differential Revision: https://phabricator.services.mozilla.com/D56937
--HG--
extra : moz-landing-system : lando
RegExp/regress-yarr-regexp.js
- Compare arrays using `assertEqArray` instead of using `Array.prototype.toSource`.
TypedObject/scalar_types.js
TypedObject/size_and_alignment.js
- Use the new `describeType` helper (see changes in TypedObject/shell.js) to
get a descriptive name for a TypedObject type.
TypedObject/shell.js
- Add `describeType` helper to mimic the output of `toSource` for TypedObject types.
- And use `JSON.stringify` to stringify TypedObject instances.
class/superPropBasicCalls.js
- Use `toString` instead of `toSource` for class property lookup tests.
- Interestingly the test class is already named `toStringTest`.
expressions/regress-96526-delelem.js
- Call `formatArray` to get the expected output, because the `formatArray` helper
generates a slightly different ouput (`"[3, , ]"`) than `Array.prototype.toSource`.
extensions/clone-v1-typed-array.js
- Use `toString` instead of `toSource` for the `print` output of an `Error` object.
extensions/dataview.js
- Use `JSON.stringify` to generate a source-like representation of an array of number values.
extensions/regress-314874.js
- Directly use `expect` and `actual` for the comparison call.
extensions/regress-459606.js
- Directly use the `toFixed` result for the comparison call.
extensions/regress-476414-01.js
extensions/regress-476414-02.js
- Remove jsfunfuzz clean-up code.
jit/regress-452498-01.js
- Use `JSON.stringify` to generate a source-like representation of an array of number values.
- Additionally fixup the ouput to match the expected string.
reflect-parse/Match.js
- Use `JSON.stringify` to get a string-representation for error messages.
Depends on D56935
Differential Revision: https://phabricator.services.mozilla.com/D56936
--HG--
extra : moz-landing-system : lando
Allow these `toSource` specific tests to run even when `toSource` is not defined.
Depends on D56934
Differential Revision: https://phabricator.services.mozilla.com/D56935
--HG--
extra : moz-landing-system : lando
These tests can be removed when `toSource` itself is removed.
Depends on D56933
Differential Revision: https://phabricator.services.mozilla.com/D56934
--HG--
extra : moz-landing-system : lando
And additionally remove tests for deleted extensions like `Object.prototype.watch`.
Depends on D56932
Differential Revision: https://phabricator.services.mozilla.com/D56933
--HG--
extra : moz-landing-system : lando
This test was added for an e4x bug and originally contained `<e4x>{x}</e4x>;`
after `print(x.length);`. When e4x was removed, `<e4x>{x}</e4x>;` was deleted
from the test file instead of directly deleting the whole file.
Depends on D56931
Differential Revision: https://phabricator.services.mozilla.com/D56932
--HG--
extra : moz-landing-system : lando
lib/*.js
- Replace `uneval` with `JSON.stringify`, because the result is only used for
`print` output or error messages.
etc/generate-nosuchproperty-tests.js
- Use normal Function.p.toString representation instead of `uneval`.
Depends on D56928
Differential Revision: https://phabricator.services.mozilla.com/D56930
--HG--
extra : moz-landing-system : lando
asm.js/testBug1057248.js
collections/Map-iterator-remove-1.js
gc/bug-1075546.js
heap-analysis/findPath.js
profiler/AutoEntryMonitor-01.js
proxy/testDirectProxySetReceiverLookup.js
saved-stacks/principals-01.js
saved-stacks/principals-02.js
- Use `JSON.stringify` here, too. (The exact result isn't relevant for theses tests.)
baseline/bug845331.js
- Use `Function.p.toString` instead of `uneval` to get the source reprensentation.
- `toString` is implicitly called through `String` to keep the test structure the same,
in case that's important for this test.
fields/bug1540798.js
- Directly call `Function.p.toString` instead of implicitly through `uneval(global)`.
- This ensures the test semantics are kept intact.
for-of/decompiler.js
- Use `JSON.stringify` to get a quoted string.
gc/bug-1259490.js
heap-analysis/byteSize-of-scripts.js
saved-stacks/async-max-frame-count.js
- Use `String` to get the string representation of a number value.
gc/bug-832103.js
- Use `String` here, too. (The exact result isn't relevant for theses tests.)
gc/bug-886630.js
- Remove jsfunfuzz clean-up code referencing `uneval`.
saved-stacks/1438121-async-function.js
saved-stacks/1438121-generator.js
- Use `JSON.stringify` to get a source-like representation of an object.
- And also use `JSON.stringify` to quote a string value.
Depends on D56927
Differential Revision: https://phabricator.services.mozilla.com/D56928
--HG--
extra : moz-landing-system : lando
debug/Environment-variables.js
- Use `String` instead of `uneval` for the string representation of a number value.
debug/*.js
- Replace `uneval` with `JSON.stringify`.
- The exact result isn't relevant, because it's only used in `print` calls.
Depends on D56926
Differential Revision: https://phabricator.services.mozilla.com/D56927
--HG--
extra : moz-landing-system : lando
auto-regress/bug486139.js
auto-regress/bug522624.js
auto-regress/bug562028.js
auto-regress/bug584423.js
- Mark `uneval`-only tests accordingly.
auto-regress/bug580694.js
auto-regress/bug736609.js
- Replace `uneval()` with `String()`, because the result isn't observed anyway.
auto-regress/bug605011.js
auto-regress/bug745452.js
- Use `JSON.stringify` to traverse the global object instead of `uneval`.
Depends on D56925
Differential Revision: https://phabricator.services.mozilla.com/D56926
--HG--
extra : moz-landing-system : lando
basic/array-copyWithin.js
basic/bug951346.js
basic/shell-principals.js
basic/testNEWINIT.js
- Use `JSON.stringify` to get the source-like representation of an object.
basic/bug1001090-3.js
basic/bug1001090-4.js
basic/bug1078871.js
basic/testDenseArrayProp.js
basic/testGCWhileRecording.js
- Use `JSON.stringify` here, too. (The exact result isn't relevant for theses tests.)
basic/bug699166.js
basic/bug744285.js
- Replace `uneval()` with `String()`, because it doesn't matter if "(void 0)" or "" is used.
basic/bug913445.js
- Mark `uneval`-only test accordingly.
basic/parseIntTests.js
- Replace `uneval` on number values with `String`, plus special-casing `-0`.
basic/truthies.js
- Add a simple replacement function for `uneval` here.
Depends on D56924
Differential Revision: https://phabricator.services.mozilla.com/D56925
--HG--
extra : moz-landing-system : lando
ion/bug1057598.js
ion/dce-with-rinstructions.js
ion/recover-arrays.js
ion/recover-cow-arrays.js
ion/recover-lambdas.js
ion/recover-objects.js
ion/rinstructions-no-sse4.js
ion/test-scalar-replacement-float32.js
- `uceFault` is a function expression, so the manually adding parentheses around
the toString representation gives the same string as calling `uneval`.
- Same goes for the other calls to `uneval` in these files.
ion/bug1071879.js
- `uneval` is called on number values in a `print` call, replace it with `String`.
ion/bug1314438.js
ion/bug1538083.js
- Replace `uneval` with `Object.is` to test for negative zero.
ion/bug743099.js
- `uneval` isn't called, replace it with another native function
ion/bug913749.js
- Replace `uneval` with `JSON.stringify` to compute the string representation of an array.
- Replace `uneval` with `String` to convert the `.message` property (which is most likely already a string)
Depends on D56923
Differential Revision: https://phabricator.services.mozilla.com/D56924
--HG--
extra : moz-landing-system : lando
- Use `String` to generate the string representation of primitive values, including symbols.
- Use `JSON.stringify` to generate the string representation of object values.
- Add a new helper to distinguish "similar-symbols".
Depends on D56922
Differential Revision: https://phabricator.services.mozilla.com/D56923
--HG--
extra : moz-landing-system : lando
Move the `uneval` tests into new test files.
Depends on D56921
Differential Revision: https://phabricator.services.mozilla.com/D56922
--HG--
rename : js/src/tests/non262/Function/function-bind.js => js/src/tests/non262/extensions/uneval/function-bind.js
rename : js/src/tests/non262/regress/regress-452498-082.js => js/src/tests/non262/extensions/uneval/regress-452498-082.js
rename : js/src/tests/non262/regress/regress-452498-117.js => js/src/tests/non262/extensions/uneval/regress-452498-117.js
extra : moz-landing-system : lando
extensions/regress-311792-01.js
- Replace `uneval` with `join` to trigger array traversal and stringification per the original test case.
extensions/regress-363040-01.js
extensions/regress-363040-02.js
- `a` and `frac` are Array objects which can stringified implicitly in these `print` calls.
- The `print` calls itself weren't removed, because the both "test" files are actually
only example code and don't contain any proper assertions.
extensions/regress-476414-01.js
extensions/regress-476414-02.js
- `uneval` only referenced in jsfunfuzz clean-up code.
extensions/regress-465453.js
- Replace `uneval` on array with calling `Array.prototype.toString`.
extensions/regress-465337.js
extensions/regress-465276.js
- Replace `uneval` with `assertEqArray` to ensure the array contains the expected values.
extensions/regress-407501.js
- Replace `uneval` on array with calling `Array.prototype.toString`.
extensions/regress-363988.js
- Replace `uneval` with `JSON.stringify` to build JS source string.
regress/regress-477234.js
- Remove references to `uneval` and `toSource`.
- Deleting and re-adding these properties may have been necessary to trigger
the bug in TraceMonkey, but it isn't worth the trouble to validate this now.
extensions/clone-errors.js
extensions/shell.js
reflect-parse/Match.js
reflect-parse/PatternAsserts.js
regress/regress-418641.js
- Use `JSON.stringify` instead of `uneval` to generate a source-like representation for error messages.
extensions/regress-226078.js
statements/for-in-with-assignments.js
- Call `dis` instead of `uneval` to disassemble a function.
extensions/regress-476653.js
- Remove a reference to `uneval`, which may have only be necessary to trigger
a bug in TraceMonkey.
Depends on D56920
Differential Revision: https://phabricator.services.mozilla.com/D56921
--HG--
extra : moz-landing-system : lando
extensions/clone-complex-object.js
- `pa[i][0]` is `propname`, which is earlier asserted to be a string.
Error/regress-465377.js
- `tmp` is expected to be a String value, but also add an explicit `String` call to handle symbols.
- Drive-by fix: Move `tmp` definition before first use.
Symbol/enumeration.js
- `x` is required to be a string by the spec, add explicit `String` call in case this ever changes.
object/getOwnPropertySymbols-proxy.js
- `key` is required to be a string by the spec, add explicit `String` call in case this ever changes.
object/toPrimitive.js
- `trapName` is required to be a string by the spec, add explicit `String` call in case this ever changes.
regress/regress-407024.js
- Test function `f` should either return `1` or `undefined`, both are convertible to a string.
reflect-parse/Match.js
- `uneval` for only used to quote the string value, so replace by manually quoting `key`.
extensions/shell.js
- `pa[i][0]` is earlier asserted to be a string.
Depends on D56917
Differential Revision: https://phabricator.services.mozilla.com/D56918
--HG--
extra : moz-landing-system : lando
Remove calls to `uneval` when only used to help debugging the test code, e.g.
in `print(uneval(foo))`.
Depends on D56916
Differential Revision: https://phabricator.services.mozilla.com/D56917
--HG--
extra : moz-landing-system : lando
Lazy scripts were using the IsModule flag with different semantics than
compiled scripts and so this patch adds a new flag instead. The flag is
initialized from non-lazy scripts for consistency.
Differential Revision: https://phabricator.services.mozilla.com/D57220
--HG--
extra : moz-landing-system : lando
Update js::CanReuseScriptForClone to use baseScript() to determine if
non-syntactic. The HasNonSyntacticScope is not computed for lazy scripts so
fall back to checking the scope. Technically this is a fraction slower when
cloning a script with a syntactic global into a function with a non-syntactic
global, but in that case we are just about to clone the entire script
anyways. In practice this rarely comes up.
Differential Revision: https://phabricator.services.mozilla.com/D57209
--HG--
extra : moz-landing-system : lando
Lift the code that checks JS values against reference types (and boxes anyref)
from all the places where it is repeated into a common function.
Clean up some code that assumes that the only reference types are anyref
and funcref.
Differential Revision: https://phabricator.services.mozilla.com/D56971
--HG--
extra : moz-landing-system : lando
The return value of a wasm builtin call may just be used to check if the
runtime caused an internal error (e.g. oom). There are assertions in code that
the return value of wasm builtins not supposed to return a wasm value actually
do this, so we shouldn't return values that are only internally used.
This could have been done a simpler way by only having "FailureMode::NotZero"
imply "do not return", but this is more future-proof like this: shared memory
/ atomics builtins both check the internal value *and* return it to the wasm
value stack.
Differential Revision: https://phabricator.services.mozilla.com/D57125
--HG--
extra : moz-landing-system : lando
This way we get proper JIT tiering. It will also make it possible to
assert all backward jumps are to a JSOP_LOOPHEAD.
Differential Revision: https://phabricator.services.mozilla.com/D56715
--HG--
extra : moz-landing-system : lando
Before this bug:
* We did not add phis for expression stack slots that aren't part of the loop.
* We disallowed OSR into Ion at loops that have such non-loop stack slots.
This goes back to bug 980263 to fix the following problem: JSOP_INITPROP in
IonBuilder assumed it found MNewObject on the stack and got confused when it
found a loop phi instead. There was a similar issue with MNewArray.
Since then the affected ops have been fixed and supporting OSR at these loops
(and inserting phis for all stack slots) simplifies the code and fixes a potential
perf cliff.
Depends on D56699
Differential Revision: https://phabricator.services.mozilla.com/D56700
--HG--
extra : moz-landing-system : lando
This test failed with the upcoming changes without bug 1602720, because
the old isNewArray() condition ignored loop phis.
Depends on D56698
Differential Revision: https://phabricator.services.mozilla.com/D56699
--HG--
extra : moz-landing-system : lando
I am open to wording improvements for the error message. Right now we get:
js> new BigInt64Array(new Float32Array(4))
TypeError: Float32Array array elements are incompatible with BigInt64Array
and
js> x = new Float32Array(4); x.set(new BigInt64Array(2))
TypeError: BigInt64Array array elements are incompatible with Float32Array
Differential Revision: https://phabricator.services.mozilla.com/D57208
--HG--
extra : moz-landing-system : lando
The explanation for why the code was correct is subtle and not super convincing.
Fortunately TypeSet::mightBeMIRType and MDefinition::mightBeType callers
are easy to audit because they're mostly called with a constant MIRType.
The patch fixes these callers:
* ArgumentTypesMatch: surprisingly, the calleeTypes->unknown() check was missing. If the callee has unknown types then it's definitely OK to pass any Value to it without checking. If not unknown, don't bother handling untracked magic types as it's uncommon.
* ObjectOrSimplePrimitive and SimpleArithOperand: changed to mightBeMagicType.
* MPhi::typeIncludes: I'm not sure if magic types are possible but I changed the single caller, TypeAnalyzer::adjustPhiInputs, to not handle them.
Differential Revision: https://phabricator.services.mozilla.com/D57088
--HG--
extra : moz-landing-system : lando
I was wondering if we have to check for the other magic types there.
This patch documents why we don't, and we now crash safely if this
turns out to be wrong.
Differential Revision: https://phabricator.services.mozilla.com/D57084
--HG--
extra : moz-landing-system : lando
Having a method to construct a TypeSet::Type from a ValueType is a footgun
because ValueType::Magic is used for all magic values but TypeSet::Type can
only represent the JS_OPTIMIZED_ARGUMENTS magic value.
We now pass either a MIRType or JS::Value. Both of these can represent specific
magic value types so the previously lossy conversions are now guaranteed to
assert/crash or are treated as UnknownType().
This also fixes PrimitiveType(type) to not accept objects. PrimitiveOrAnyObjectType
is now used instead.
Depends on D56912
Differential Revision: https://phabricator.services.mozilla.com/D56913
--HG--
extra : moz-landing-system : lando
