Bug 1673553 part 18 - Remove some ObjectGroup flags. r=iain
authorJan de Mooij <jdemooij@mozilla.com>
Wed, 18 Nov 2020 15:47:38 +0000
changeset 557819 66c92d861375bcf2e5d21b7e406b0fc742c0e689
parent 557818 d6cdc2a48fa7a24765684fe82771632cc6f59b79
child 557820 fc68cf76fcfc5ff9a54f2339daf578414470191f
push id37962
push userapavel@mozilla.com
push dateWed, 18 Nov 2020 21:51:58 +0000
treeherdermozilla-central@9d797387f57c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersiain
bugs1673553
milestone85.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1673553 part 18 - Remove some ObjectGroup flags. r=iain Differential Revision: https://phabricator.services.mozilla.com/D97298
js/src/vm/ArrayObject-inl.h
js/src/vm/Iteration.cpp
js/src/vm/JSObject-inl.h
js/src/vm/JSObject.cpp
js/src/vm/JSObject.h
js/src/vm/NativeObject-inl.h
js/src/vm/NativeObject.cpp
js/src/vm/ObjectGroup.cpp
js/src/vm/Shape.h
js/src/vm/TypeSet.h
--- a/js/src/vm/ArrayObject-inl.h
+++ b/js/src/vm/ArrayObject-inl.h
@@ -19,22 +19,16 @@
 #include "vm/TypeInference-inl.h"
 
 namespace js {
 
 inline void ArrayObject::setLength(JSContext* cx, uint32_t length) {
   MOZ_ASSERT(lengthIsWritable());
   MOZ_ASSERT_IF(length != getElementsHeader()->length,
                 !denseElementsAreFrozen());
-
-  if (length > INT32_MAX) {
-    /* Track objects with overflowing lengths in type information. */
-    MarkObjectGroupFlags(cx, this, OBJECT_FLAG_LENGTH_OVERFLOW);
-  }
-
   getElementsHeader()->length = length;
 }
 
 /* static */ inline ArrayObject* ArrayObject::createArrayInternal(
     JSContext* cx, gc::AllocKind kind, gc::InitialHeap heap, HandleShape shape,
     HandleObjectGroup group, AutoSetNewObjectMetadata&) {
   const JSClass* clasp = group->clasp();
   MOZ_ASSERT(shape && group);
--- a/js/src/vm/Iteration.cpp
+++ b/js/src/vm/Iteration.cpp
@@ -930,23 +930,16 @@ static JSObject* GetIterator(JSContext* 
     numGuards = 0;
   }
 
   RootedIdVector keys(cx);
   if (!EnumerateProperties(cx, obj, &keys)) {
     return nullptr;
   }
 
-  if (IsTypeInferenceEnabled()) {
-    if (obj->isSingleton() && !JSObject::setIteratedSingleton(cx, obj)) {
-      return nullptr;
-    }
-    MarkObjectGroupFlags(cx, obj, OBJECT_FLAG_ITERATED);
-  }
-
   // If the object has dense elements, mark the dense elements as
   // maybe-in-iteration.
   //
   // The iterator is a snapshot so if indexed properties are added after this
   // point we don't need to do anything. However, the object might have sparse
   // elements now that can be densified later. To account for this, we set the
   // maybe-in-iteration flag also in NativeObject::maybeDensifySparseElements.
   //
--- a/js/src/vm/JSObject-inl.h
+++ b/js/src/vm/JSObject-inl.h
@@ -278,20 +278,16 @@ MOZ_ALWAYS_INLINE bool JSObject::maybeHa
   return true;
 }
 
 inline bool JSObject::staticPrototypeIsImmutable() const {
   MOZ_ASSERT(hasStaticPrototype());
   return hasAllFlags(js::BaseShape::IMMUTABLE_PROTOTYPE);
 }
 
-inline bool JSObject::isIteratedSingleton() const {
-  return hasAllFlags(js::BaseShape::ITERATED_SINGLETON);
-}
-
 inline bool JSObject::isNewGroupUnknown() const {
   return hasAllFlags(js::BaseShape::NEW_GROUP_UNKNOWN);
 }
 
 namespace js {
 
 static MOZ_ALWAYS_INLINE bool IsFunctionObject(const js::Value& v) {
   return v.isObject() && v.toObject().is<JSFunction>();
--- a/js/src/vm/JSObject.cpp
+++ b/js/src/vm/JSObject.cpp
@@ -3526,17 +3526,16 @@ void JSObject::dump(js::GenericPrinter& 
   if (obj->isDelegate()) out.put(" delegate");
   if (!obj->is<ProxyObject>() && !obj->nonProxyIsExtensible())
     out.put(" not_extensible");
   if (obj->maybeHasInterestingSymbolProperty())
     out.put(" maybe_has_interesting_symbol");
   if (obj->isBoundFunction()) out.put(" bound_function");
   if (obj->isQualifiedVarObj()) out.put(" varobj");
   if (obj->isUnqualifiedVarObj()) out.put(" unqualified_varobj");
-  if (obj->isIteratedSingleton()) out.put(" iterated_singleton");
   if (obj->isNewGroupUnknown()) out.put(" new_type_unknown");
   if (obj->hasUncacheableProto()) out.put(" has_uncacheable_proto");
   if (obj->hasStaticPrototype() && obj->staticPrototypeIsImmutable()) {
     out.put(" immutable_prototype");
   }
 
   const NativeObject* nobj =
       obj->isNative() ? &obj->as<NativeObject>() : nullptr;
--- a/js/src/vm/JSObject.h
+++ b/js/src/vm/JSObject.h
@@ -364,26 +364,16 @@ class JSObject
 
   // True iff this object's [[Prototype]] is immutable.  Must be called only
   // on objects with a static [[Prototype]]!
   inline bool staticPrototypeIsImmutable() const;
 
   inline void setGroup(js::ObjectGroup* group);
 
   /*
-   * Mark an object that has been iterated over and is a singleton. We need
-   * to recover this information in the object's type information after it
-   * is purged on GC.
-   */
-  inline bool isIteratedSingleton() const;
-  static bool setIteratedSingleton(JSContext* cx, JS::HandleObject obj) {
-    return setFlags(cx, obj, js::BaseShape::ITERATED_SINGLETON);
-  }
-
-  /*
    * Mark an object as requiring its default 'new' type to have unknown
    * properties.
    */
   inline bool isNewGroupUnknown() const;
   static bool setNewGroupUnknown(JSContext* cx, js::ObjectGroupRealm& realm,
                                  const JSClass* clasp, JS::HandleObject obj);
 
   /* Set a new prototype for an object with a singleton type. */
--- a/js/src/vm/NativeObject-inl.h
+++ b/js/src/vm/NativeObject-inl.h
@@ -114,32 +114,26 @@ inline void NativeObject::initDenseEleme
 inline void NativeObject::setDenseElementHole(JSContext* cx, uint32_t index) {
   markDenseElementsNotPacked(cx);
   setDenseElementUnchecked(index, MagicValue(JS_ELEMENTS_HOLE));
 }
 
 inline void NativeObject::removeDenseElementForSparseIndex(JSContext* cx,
                                                            uint32_t index) {
   MOZ_ASSERT(containsPure(INT_TO_JSID(index)));
-  if (IsTypeInferenceEnabled()) {
-    MarkObjectGroupFlags(cx, this, OBJECT_FLAG_SPARSE_INDEXES);
-  }
   if (containsDenseElement(index)) {
     setDenseElementHole(cx, index);
   }
 }
 
+// TODO(no-TI): remove cx argument.
 inline void NativeObject::markDenseElementsNotPacked(JSContext* cx) {
   MOZ_ASSERT(isNative());
 
   getElementsHeader()->markNonPacked();
-
-  if (IsTypeInferenceEnabled()) {
-    MarkObjectGroupFlags(cx, this, OBJECT_FLAG_NON_PACKED);
-  }
 }
 
 inline void NativeObject::elementsRangePostWriteBarrier(uint32_t start,
                                                         uint32_t count) {
   if (!isTenured()) {
     return;
   }
   for (size_t i = 0; i < count; i++) {
@@ -923,20 +917,16 @@ inline bool IsPackedArray(JSObject* obj)
   }
 
   ArrayObject* arr = &obj->as<ArrayObject>();
   if (arr->getDenseInitializedLength() != arr->length()) {
     return false;
   }
 
   if (!arr->denseElementsArePacked()) {
-    // Assert TI agrees the elements are not packed.
-    MOZ_ASSERT_IF(
-        !arr->hasLazyGroup(),
-        arr->group()->hasAllFlagsDontCheckGeneration(OBJECT_FLAG_NON_PACKED));
     return false;
   }
 
 #ifdef DEBUG
   // Assert correctness of the NON_PACKED flag by checking the first few
   // elements don't contain holes.
   uint32_t numToCheck = std::min<uint32_t>(5, arr->getDenseInitializedLength());
   for (uint32_t i = 0; i < numToCheck; i++) {
--- a/js/src/vm/NativeObject.cpp
+++ b/js/src/vm/NativeObject.cpp
@@ -165,17 +165,16 @@ bool ObjectElements::MakeElementsCopyOnW
 bool ObjectElements::PrepareForPreventExtensions(JSContext* cx,
                                                  NativeObject* obj) {
   if (!obj->maybeCopyElementsForWrite(cx)) {
     return false;
   }
 
   if (!obj->hasEmptyElements()) {
     obj->shrinkCapacityToInitializedLength(cx);
-    MarkObjectGroupFlags(cx, obj, OBJECT_FLAG_NON_EXTENSIBLE_ELEMENTS);
   }
 
   // shrinkCapacityToInitializedLength ensures there are no shifted elements.
   MOZ_ASSERT(obj->getElementsHeader()->numShiftedElements() == 0);
 
   return true;
 }
 
--- a/js/src/vm/ObjectGroup.cpp
+++ b/js/src/vm/ObjectGroup.cpp
@@ -150,31 +150,17 @@ bool JSObject::splicePrototype(JSContext
 }
 
 /* static */
 ObjectGroup* JSObject::makeLazyGroup(JSContext* cx, HandleObject obj) {
   MOZ_ASSERT(obj->hasLazyGroup());
   MOZ_ASSERT(cx->compartment() == obj->compartment());
 
   // Find flags which need to be specified immediately on the object.
-  // Don't track whether singletons are packed.
-  ObjectGroupFlags initialFlags =
-      OBJECT_FLAG_SINGLETON | OBJECT_FLAG_NON_PACKED;
-
-  if (obj->isIteratedSingleton()) {
-    initialFlags |= OBJECT_FLAG_ITERATED;
-  }
-
-  if (obj->isNative() && obj->as<NativeObject>().isIndexed()) {
-    initialFlags |= OBJECT_FLAG_SPARSE_INDEXES;
-  }
-
-  if (obj->is<ArrayObject>() && obj->as<ArrayObject>().length() > INT32_MAX) {
-    initialFlags |= OBJECT_FLAG_LENGTH_OVERFLOW;
-  }
+  ObjectGroupFlags initialFlags = OBJECT_FLAG_SINGLETON;
 
   Rooted<TaggedProto> proto(cx, obj->taggedProto());
   ObjectGroup* group = ObjectGroupRealm::makeGroup(
       cx, obj->nonCCWRealm(), obj->getClass(), proto, initialFlags);
   if (!group) {
     return nullptr;
   }
 
--- a/js/src/vm/Shape.h
+++ b/js/src/vm/Shape.h
@@ -690,17 +690,17 @@ class BaseShape : public gc::TenuredCell
      */
 
     DELEGATE = 0x8,
     NOT_EXTENSIBLE = 0x10,
     INDEXED = 0x20,
     HAS_INTERESTING_SYMBOL = 0x40,
     HAD_ELEMENTS_ACCESS = 0x80,
     FROZEN_ELEMENTS = 0x100,  // See ObjectElements::FROZEN comment.
-    ITERATED_SINGLETON = 0x200,
+    // 0x200 is unused.
     NEW_GROUP_UNKNOWN = 0x400,
     UNCACHEABLE_PROTO = 0x800,
     IMMUTABLE_PROTOTYPE = 0x1000,
 
     // See JSObject::isQualifiedVarObj().
     QUALIFIED_VAROBJ = 0x2000,
 
     // 0x4000 is unused.
--- a/js/src/vm/TypeSet.h
+++ b/js/src/vm/TypeSet.h
@@ -78,38 +78,16 @@ enum : uint32_t {
   OBJECT_FLAG_SINGLETON = 0x2,
 
   /*
    * Whether this group is used by objects whose singleton groups have not
    * been created yet.
    */
   OBJECT_FLAG_LAZY_SINGLETON = 0x4,
 
-  /* Whether any objects this represents may have sparse indexes. */
-  OBJECT_FLAG_SPARSE_INDEXES = 0x00010000,
-
-  /* Whether any objects this represents may not have packed dense elements. */
-  OBJECT_FLAG_NON_PACKED = 0x00020000,
-
-  /*
-   * Whether any objects this represents may be arrays whose length does not
-   * fit in an int32.
-   */
-  OBJECT_FLAG_LENGTH_OVERFLOW = 0x00040000,
-
-  /* Whether any objects have been iterated over. */
-  OBJECT_FLAG_ITERATED = 0x00080000,
-
-  /* Whether any object this represents may have non-extensible elements. */
-  OBJECT_FLAG_NON_EXTENSIBLE_ELEMENTS = 0x00100000,
-
-  // (0x00200000 is unused)
-
-  // (0x00400000 is unused)
-
   /*
    * Whether objects with this type should be allocated directly in the
    * tenured heap.
    */
   OBJECT_FLAG_PRE_TENURE = 0x00800000,
 
   /* Whether objects with this type might have copy on write elements. */
   OBJECT_FLAG_COPY_ON_WRITE = 0x01000000,