wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 912316 - Ensure that Ion get ICs don't incur unwanted lookup-based side-effects. (r=djvj)

Browse Source
This commit is contained in:
Eric Faust 2013-09-09 16:25:56 -07:00
parent 464fee6713
commit e96490055b
2 changed files with 5 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
js/src/jit/IonCaches.cpp
View File

@ -1117,16 +1117,13 @@ CanAttachNativeGetProp(typename GetPropCache::Context cx, const GetPropCache &ca
if (!obj || !obj->isNative())
return GetPropertyIC::CanAttachNone;
// If the cache is idempotent or parallel, watch out for resolve hooks or
// non-native objects on the proto chain. We check this before calling
// lookupProperty, to make sure no effectful lookup hooks or resolve hooks
// are called.
if (cache.lookupNeedsIdempotentChain() && !obj->hasIdempotentProtoChain())
// The lookup needs to be universally pure, otherwise we risk calling hooks out
// of turn. We don't mind doing this even when purity isn't required, because we
// only miss out on shape hashification, which is only a temporary perf cost.
// The limits were arbitrarily set, anyways.
if (!LookupPropertyPure(obj, NameToId(name), holder.address(), shape.address()))
return GetPropertyIC::CanAttachNone;
if (!GetPropCache::doPropertyLookup(cx, obj, name, holder, shape))
return GetPropertyIC::CanAttachError;
RootedScript script(cx);
jsbytecode *pc;
cache.getScriptedLocation(&script, &pc);
@ -1209,8 +1206,6 @@ GetPropertyIC::tryAttachNative(JSContext *cx, IonScript *ion, HandleObject obj,
NativeGetPropCacheability type =
CanAttachNativeGetProp(cx, *this, obj, name, &holder, &shape);
if (type == CanAttachError)
return false;
if (type == CanAttachNone)
return true;
@ -1424,8 +1419,6 @@ GetPropertyIC::tryAttachDOMProxyUnshadowed(JSContext *cx, IonScript *ion, Handle
NativeGetPropCacheability canCache =
CanAttachNativeGetProp(cx, *this, checkObj, name, &holder, &shape);
if (canCache == CanAttachError)
return false;
if (canCache == CanAttachNone)
return true;
@ -1898,7 +1891,6 @@ GetPropertyParIC::update(ForkJoinSlice *slice, size_t cacheIndex,
GetPropertyIC::NativeGetPropCacheability canCache =
CanAttachNativeGetProp(cx, cache, obj, name, &holder, &shape);
JS_ASSERT(canCache != GetPropertyIC::CanAttachError);
if (canCache == GetPropertyIC::CanAttachReadSlot) {
if (!cache.attachReadSlot(cx, ion, obj, holder, shape))
@ -2833,9 +2825,6 @@ GetElementIC::attachGetProp(JSContext *cx, IonScript *ion, HandleObject obj,
GetPropertyIC::NativeGetPropCacheability canCache =
CanAttachNativeGetProp(cx, *this, obj, name, &holder, &shape);
if (canCache == GetPropertyIC::CanAttachError)
return false;
if (canCache != GetPropertyIC::CanAttachReadSlot) {
IonSpew(IonSpew_InlineCaches, "GETELEM uncacheable property");
return true;
@ -3484,7 +3473,6 @@ GetElementParIC::update(ForkJoinSlice *slice, size_t cacheIndex, HandleObject ob
GetPropertyIC::NativeGetPropCacheability canCache =
CanAttachNativeGetProp(cx, cache, obj, name, &holder, &shape);
JS_ASSERT(canCache != GetPropertyIC::CanAttachError);
if (canCache == GetPropertyIC::CanAttachReadSlot)
{

23
js/src/jit/IonCaches.h
View File

@ -594,7 +594,6 @@ class GetPropertyIC : public RepatchIonCache
}
enum NativeGetPropCacheability {
CanAttachError,
CanAttachNone,
CanAttachReadSlot,
CanAttachArrayLength,
@ -603,13 +602,6 @@ class GetPropertyIC : public RepatchIonCache
// Helpers for CanAttachNativeGetProp
typedef JSContext * Context;
static bool doPropertyLookup(Context cx, HandleObject obj, HandlePropertyName name,
MutableHandleObject holder, MutableHandleShape shape) {
return JSObject::lookupProperty(cx, obj, name, holder, shape);
}
bool lookupNeedsIdempotentChain() const {
return idempotent();
}
bool canMonitorSingletonUndefinedSlot(HandleObject holder, HandleShape shape) const;
bool allowArrayLength(Context cx, HandleObject obj) const;
@ -762,13 +754,8 @@ class GetElementIC : public RepatchIonCache
// Helpers for CanAttachNativeGetProp
typedef JSContext * Context;
static bool doPropertyLookup(Context cx, HandleObject obj, HandlePropertyName name,
MutableHandleObject holder, MutableHandleShape shape) {
return JSObject::lookupProperty(cx, obj, name, holder, shape);
}
bool allowGetters() const { return false; }
bool allowArrayLength(Context, HandleObject) const { return false; }
bool lookupNeedsIdempotentChain() const { return false; }
bool canMonitorSingletonUndefinedSlot(HandleObject holder, HandleShape shape) const {
return monitoredResult();
}
@ -1046,11 +1033,6 @@ class GetPropertyParIC : public ParallelIonCache
// CanAttachNativeGetProp Helpers
typedef LockedJSContext & Context;
static bool doPropertyLookup(Context cx, HandleObject obj, HandlePropertyName name,
MutableHandleObject holder, MutableHandleShape shape) {
return LookupPropertyPure(obj, NameToId(name), holder.address(), shape.address());
}
bool lookupNeedsIdempotentChain() const { return true; }
bool canMonitorSingletonUndefinedSlot(HandleObject, HandleShape) const { return true; }
bool allowGetters() const { return false; }
bool allowArrayLength(Context, HandleObject) const { return true; }
@ -1106,11 +1088,6 @@ class GetElementParIC : public ParallelIonCache
// CanAttachNativeGetProp Helpers
typedef LockedJSContext & Context;
static bool doPropertyLookup(Context cx, HandleObject obj, HandlePropertyName name,
MutableHandleObject holder, MutableHandleShape shape) {
return LookupPropertyPure(obj, NameToId(name), holder.address(), shape.address());
}
bool lookupNeedsIdempotentChain() const { return true; }
bool canMonitorSingletonUndefinedSlot(HandleObject, HandleShape) const { return true; }
bool allowGetters() const { return false; }
bool allowArrayLength(Context, HandleObject) const { return false; }