Bug 1580246: Remove object-literal singleton objects allocated at parse. r=mgaudet,jandem Instead, this patch introduces a new `ObjLiteral` mini-bytecode format that is used to carry object-literal information from parse time to a later time at which GC objects are safe to allocate. The mini-bytecode simply specifies a list of fields and constant field values. The original intent of this patch (realized in previous versions of it) was to make this an opcode, and completely replace object creation sequences (NEWINIT, INITPROP, INITPROP, ...) with one OBJLITERAL opcode. However, there are quite a few performance regressions that occur when replacing the finely-tuned set of optimizations around this with a new mechanism. As a result, this patch only defers allocation of the objects until the very end of parse. Each object literal adds an ObjLiteralCreationData instance to the GC-things list, and when the GC-things list is processed to perform deferred allocations, the described objects will be created. This is a rebased version of the original patch (landed as D47985 and then backed out) with the Kraken regression (bug 1594753) fixed as noted in the bug above. Differential Revision: https://phabricator.services.mozilla.com/D52383

Bug 1556033 - Properly skip frame execution if the debugger overrides it. r=jandem The debugger allows its hooks to return explicit completion values that should take the place of any completion value of the function beig executed. It also handles tearing down any in-progress generators and such. In this case, we were attempting to treat the return completion from the debugger as if it were a real inline 'return' statement, but that attempts to evaluate the frame and run `finally` blocks and such, which we do not want because debugger completions are more like function termination with a result. Differential Revision: https://phabricator.services.mozilla.com/D52805

Bug 1596572 - make CompareStringInfinityOrNaN work with clang 5.x and C++17; r=jandem clang 5.x (which is now our minimum supported clang version as of bug 1579189) doesn't quite work with inline variables and C++17. Fortunately, we can make some straightforward changes to make the code for `CompareStringInfinityOrNan` work in such situations. Differential Revision: https://phabricator.services.mozilla.com/D53082

Bug 1468789 - Part 2: Collect inner window id information for js interpreter frames and add a mechanism to get that for jit frames r=gerald,jandem,mstange Differential Revision: https://phabricator.services.mozilla.com/D51860

Bug 1468789 - Part 1: Add window id inside realm creation options. r=jandem,bzbarsky Differential Revision: https://phabricator.services.mozilla.com/D51859

Bug 1596288 - Move some code in Bailouts.h into Bailouts.cpp that is the sole user of it. r=jandem Differential Revision: https://phabricator.services.mozilla.com/D52936

Bug 1594998 - Make standalone SpiderMonkey use libxul-like panic. r=froydnj,jandem This moves the parts of toolkit/library/rust/shared/lib.rs related to panic hooking to a new mozglue subdirectory, which will be used for things that can be statically linked to e.g. libxul, rather than in a "shared library". The panic hook is disabled when building spidermonkey via the mozjs_sys crate. Differential Revision: https://phabricator.services.mozilla.com/D52793

Bug 1566141 - implement nullish coalescence in ion monkey r=jandem Differential Revision: https://phabricator.services.mozilla.com/D51640

Bug 1566141 - make baseline work with JSOP code for coalesce r=jorendorff,jandem Differential Revision: https://phabricator.services.mozilla.com/D51639

Bug 1566141 - make interpreter work with JSOP code for coalesce r=jorendorff,jandem Differential Revision: https://phabricator.services.mozilla.com/D51638

Bug 1593971: Add type policy to MTypedArrayIndexToInt32. r=jandem MTypedArrayIndexToInt32's input can be replaced with MPhi nodes after construction. Use a type policy to ensure these MPhi node have the expected type (either Int32 or Double). Differential Revision: https://phabricator.services.mozilla.com/D52151

Bug 1594640 - Implement a new jit/FlushICache.h header, delegating to architecture-specific headers, to expose js::jit::FlushICache in a single location. r=jandem Differential Revision: https://phabricator.services.mozilla.com/D52122

Bug 1594961 - Split FrameIter-related functionality out of vm/Stack.h to vm/FrameIter.h, Activation-related functionality to vm/Activation.h, and JitActivation functionality to vm/JitActivation.h. r=jandem CLOSED TREE Differential Revision: https://phabricator.services.mozilla.com/D52315

Bug 1593801: Fix conditional load of BigInt digits. r=jandem Differential Revision: https://phabricator.services.mozilla.com/D51797

Bug 1591405 - Add BaseScript::function() and simplify code. r=jandem Instead of checking for canonical function using scope chain, we can directly use the functionOrGlobal field. By moving this to the BaseScript class we can also simplify the debugger acccess. Differential Revision: https://phabricator.services.mozilla.com/D47071

Bug 1585372 - Run InitScriptCoverage after initialization. r=jandem,nbp To allow InitScriptCoverage to be more flexible, we need to delay the call until the JSScript is actually initialized. This moves the calls from JSScript constructor until the JSScript is actually initialized. This is similar to the debugger onNewScript call, but more cleanup would be needed to unify these. Differential Revision: https://phabricator.services.mozilla.com/D51473

Bug 1593354 - Add BaseScript::IsFunction flag. r=jandem Set this flag for scripts that are for functions. This is equivalent to checking the kind of the bodyScope() but is safe to call in GC contexts such as finalization. Also use an isFunction() accessor instead of checking if JSScript::function() is nullptr throughout the codebase. Similarly, cleanup similar uses of JSScript::module(). Differential Revision: https://phabricator.services.mozilla.com/D51472

Bug 1582348 - Enable writable streams in the browser when the javascript.options.{,writable_}streams prefs are set. (Writable streams are only half-implemented; DO NOT start reporting bugs yet, it *will* crash in all sorts of trivial ways.) r=jandem Differential Revision: https://phabricator.services.mozilla.com/D51049

Bug 1526870 - Part 16: Change Proxy CacheIR VM functions to use unboxed returned types when possible. r=jandem Differential Revision: https://phabricator.services.mozilla.com/D51072

Bug 1526870 - Part 15: Use AutoCallVM for additional CacheIR emitters. r=jandem Use a single implementation in CacheIRCompiler.cpp for CacheIR emitters which can be updated to the changed AutoCallVM class. Differential Revision: https://phabricator.services.mozilla.com/D49922

Bug 1526870 - Part 14: Deduce return types in AutoCallVM. r=jandem The previous parts had separate Baseline and Ion implementations for some CacheIR ops, because AutoCallVM only supports Values as the return type. With this patch AutoCallVM can deduce the return types from VM calls, so more return types than just Values can be supported. Differential Revision: https://phabricator.services.mozilla.com/D49921

Bug 1526870 - Part 13: Support BigInt x String comparisons. r=jandem Comparisons between BigInts and Strings is the only remaining unsupported sloppy equality operation. Add support for these operand types, so there's no unexpected performance cliff for non-Object operands in equality comparisons. Differential Revision: https://phabricator.services.mozilla.com/D49920

Bug 1526870 - Part 12: Specialise BigInt x Int32 comparisons. r=jandem When comparing a BigInt against an Int32, it's not actually necessary to call into the VM, because we only need to perform some range checks and unsigned comparisons, which can all be performed directly in inline assembly. This gives another easy >2x performance improvement compared to the previous part. Differential Revision: https://phabricator.services.mozilla.com/D49918

Bug 1526870 - Part 11: Support BigInt x Number comparisons. r=jandem Adds support to compare BigInt and Number values against each other. In contrast to binary operations, comparison operations allow mixing BigInts and Numbers. For example when testing if a BigInt value is negative, `bigInt < 0` can be used in addition to `bigInt < 0n`. Differential Revision: https://phabricator.services.mozilla.com/D49917

Bug 1526870 - Part 11.a: Add support for (double, int) -> int ABI calls to the ARM simulators. r=jandem Differential Revision: https://phabricator.services.mozilla.com/D51263

Bug 1526870 - Part 10: Support the missing equality ops cases for Boolean values. r=jandem Comparing Booleans with either Doubles or Strings always performs ToNumber on the Boolean operand. So when we add a Boolean to (boxed) Number operation to CacheIR, we can reuse the existing support for comparing Numbers resp. comparing Numbers and Strings and further trim down the list of unsupported sloppy equality operations. Differential Revision: https://phabricator.services.mozilla.com/D49916

Bug 1526870 - Part 9: Support the missing equality ops cases for Symbol values. r=jandem Comparing a Symbol with one of {String,Boolean,Number,BigInt} is always false (resp. true for NE/STRICTNE), so it's easy to support this case, too. Differential Revision: https://phabricator.services.mozilla.com/D49915

Bug 1526870 - Part 8: Update list of unsupported sloppy equality ops. r=jandem The list of unsupported operations with missing some entries and wasn't consistent when to omit equivalent cases. Differential Revision: https://phabricator.services.mozilla.com/D49914

Bug 1526870 - Part 7: Replace LBitOpV with LBinaryV. r=jandem The separate `LBitOpV` class is no longer needed, because `LBitOpV` and `LBinaryV` now both use `Value` for their input and output parameters. Differential Revision: https://phabricator.services.mozilla.com/D49913

Bug 1526870 - Part 6: Support bitwise- and shift-operations in Ion CacheIR. r=jandem Ion never emitted MBinaryCache for bitwise- and shift-operations, so we never used Ion CacheIR for these operations on BigInt values and instead always emitted a LBitOpV, i.e. a VM call. With this patch, the changes in part 4 now also lead to a performance improvement in Ion code. Differential Revision: https://phabricator.services.mozilla.com/D49912

Bug 1526870 - Part 5: Handle BigInts via abi-call in CompareIRGenerator. r=jandem Adds new CacheIR ops to support comparison operations with BigInt operands. All methods simply call into the VM to perform the actual operation. Comparisons between two BigInt values can't GC or perform any side-effects, so we can use an ABI call, which saves us an extra indirection through a VM function wrapper and makes it possible to use a shared implementation in CacheIRCompiler.cpp. Differential Revision: https://phabricator.services.mozilla.com/D49911

Bug 1526870 - Part 4: Handle BigInts via vm-call in BinaryArithIRGenerator. r=jandem Adds new CacheIR ops to support binary operations with BigInt operands. All methods simply call into the VM to perform the actual operation. JSOP_URSH isn't supported because it always throws when used with BigInts. Parts 14/15 move the separate Baseline and Ion implementations into a single implementation in CacheIRCompiler. Differential Revision: https://phabricator.services.mozilla.com/D49910

Bug 1526870 - Part 3: Handle BigInts via vm-call in UnaryArithIRGenerator. r=jandem Adds new CacheIR ops to support unary operations with BigInt operands. All methods simply call into the VM to perform the actual operation. Parts 14/15 move the separate Baseline and Ion implementations into a single implementation in CacheIRCompiler. Differential Revision: https://phabricator.services.mozilla.com/D49909

Bug 1526870 - Part 2: Support BigInts in ToBoolIRGenerator. r=jandem Adds the 'LoadBigIntTruthyResult' CacheIR op to handle BigInts in boolean contexts. Differential Revision: https://phabricator.services.mozilla.com/D49908

Bug 1526870 - Part 1: Support BigInts in VMFunctions. r=jandem Adds support for BigInt argument and return types to VM functions. Differential Revision: https://phabricator.services.mozilla.com/D49907

Bug 1592936 - Remove unncessary check that helper threads have been started in GCParallelTask::startWithLockHeld r=jandem Differential Revision: https://phabricator.services.mozilla.com/D51274

Bug 1592537 - When waiting for a GC task, run it on the main thread if has not yet been picked up by a helper thread r=jandem Differential Revision: https://phabricator.services.mozilla.com/D51104

Bug 1592537 - Give GCParallelTask a new 'running' state and refactor r=jandem The new state is entered when the task starts executing on a helper thread. This is so we can tell the difference between tasks we have dispatched and those that have actually started running. Differential Revision: https://phabricator.services.mozilla.com/D51103

Bug 1592958 - Ensure new WebAssembly blocks have slots enough for predecessor results r=jandem Differential Revision: https://phabricator.services.mozilla.com/D51259

Bug 1590694 - Use const GCPtrs where possible r=jandem This replaces GCPtr members with const GCPtr where trival to do so. Depends on D50618 Differential Revision: https://phabricator.services.mozilla.com/D50619

Bug 1590694 - Make it possible to use const GC wrappers r=jandem The main change is to make BarrieredBase::unsafeUnbarrieredForTracing() const and use const_cast to get return the non-const pointer. This makes sense because the GC is allowed to update the pointer used while preseving the logical value of the cell, e.g. when compacting. Differential Revision: https://phabricator.services.mozilla.com/D50618

Bug 1590694 - Use const GCPtrs where possible r=jandem This replaces GCPtr members with const GCPtr where trival to do so. Depends on D50618 Differential Revision: https://phabricator.services.mozilla.com/D50619

Bug 1590694 - Make it possible to use const GC wrappers r=jandem The main change is to make BarrieredBase::unsafeUnbarrieredForTracing() const and use const_cast to get return the non-const pointer. This makes sense because the GC is allowed to update the pointer used while preseving the logical value of the cell, e.g. when compacting. Differential Revision: https://phabricator.services.mozilla.com/D50618

Bug 1129202 - Part 10: Handle TypedArray non-int32 indices in GetPropIRGenerator. r=jandem That way CacheIR can still attach an IC and Baseline/Ion don't need to take the slow path when a TypedArray access happens through a Double not representable as an Int32. Differential Revision: https://phabricator.services.mozilla.com/D39045

Bug 1129202 - Part 9: Handle TypedArray non-int32 indices in HasPropIRGenerator. r=jandem That way CacheIR can still attach an IC and Baseline/Ion don't need to take the slow path when a TypedArray access happens through a Double not representable as a (positive) Int32. Differential Revision: https://phabricator.services.mozilla.com/D39044

Bug 1129202 - Part 8: Handle TypedArray non-int32 indices in SetPropIRGenerator. r=jandem Negative int32 and doubles can both be optimised for TypedArray accesses due to the fact that any number is a canonical numeric index. With this change any TypedArray access with a double index can be optimised without regressing bug 1535031 or bug 1526315. Differential Revision: https://phabricator.services.mozilla.com/D39043

Bug 1129202 - Part 7: Add MTypedArrayIndexToInt32 for accessing TypedArrays with any Double index. r=jandem The definition of canonical numeric index strings means that any access into a TypedArray with a Double index never reads from the prototype chain. Instead if the Double is not representable as an Int32, the access is equivalent to an out-of-bounds access. That means we can substitute any non-Int32 Double index with an arbitrary index which is OOB. This helps to avoid deoptimising TypedArray accesses with non-Int32 Double values by handling them as normal out-of-bounds accesses, which are already optimisable. Differential Revision: https://phabricator.services.mozilla.com/D39041

Bug 1129202 - Part 6: Add constant for maximum TypedArray length. r=jandem The next parts use this constant in static_asserts. Differential Revision: https://phabricator.services.mozilla.com/D39040

Bug 1129202 - Part 5: Enable now passing test262 tests. r=jandem Differential Revision: https://phabricator.services.mozilla.com/D39039

Bug 1129202 - Part 4: Allow numbers with fractional parts or exponents for canonical numeric indices. r=jandem Differential Revision: https://phabricator.services.mozilla.com/D39038