Bug 1505574 - Remove Unboxed Objects from jit/ - Part 3 r=iain
authorMatthew Gaudet <mgaudet@mozilla.com>
Fri, 22 Mar 2019 15:32:47 +0000
changeset 465717 6b55560f4da9abf1987b7417831c86f7819d5f7c
parent 465716 c54c4aa147f910b4fdfa873d4e1e948f1c37cebf
child 465718 d4383df46286ab737ce478764cfc07acbe6f5c7f
push id35746
push usershindli@mozilla.com
push dateSat, 23 Mar 2019 09:46:24 +0000
treeherdermozilla-central@02b7484f316b [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersiain
bugs1505574
milestone68.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1505574 - Remove Unboxed Objects from jit/ - Part 3 r=iain Differential Revision: https://phabricator.services.mozilla.com/D24046
js/src/jit/BaselineIC.cpp
js/src/jit/BaselineIC.h
js/src/jit/IonIC.cpp
js/src/jit/MCallOptimize.cpp
js/src/jit/OptimizationTracking.cpp
js/src/jit/Recover.cpp
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -43,17 +43,16 @@
 #include "jit/MacroAssembler-inl.h"
 #include "jit/shared/Lowering-shared-inl.h"
 #include "jit/SharedICHelpers-inl.h"
 #include "jit/VMFunctionList-inl.h"
 #include "vm/EnvironmentObject-inl.h"
 #include "vm/Interpreter-inl.h"
 #include "vm/JSScript-inl.h"
 #include "vm/StringObject-inl.h"
-#include "vm/UnboxedObject-inl.h"
 
 using mozilla::DebugOnly;
 
 namespace js {
 namespace jit {
 
 #ifdef JS_JITSPEW
 void FallbackICSpew(JSContext* cx, ICFallbackStub* stub, const char* fmt, ...) {
@@ -1709,26 +1708,20 @@ bool DoTypeUpdateFallback(JSContext* cx,
   MOZ_ASSERT(stub->isCacheIR_Updated());
 
   RootedScript script(cx, frame->script());
   RootedObject obj(cx, &objval.toObject());
 
   RootedId id(cx, stub->toCacheIR_Updated()->updateStubId());
   MOZ_ASSERT(id.get() != JSID_EMPTY);
 
-  // The group should match the object's group, except when the object is
-  // an unboxed expando object: in that case, the group is the group of
-  // the unboxed object.
+  // The group should match the object's group.
   RootedObjectGroup group(cx, stub->toCacheIR_Updated()->updateStubGroup());
 #ifdef DEBUG
-  if (obj->is<UnboxedExpandoObject>()) {
-    MOZ_ASSERT(group->clasp() == &UnboxedPlainObject::class_);
-  } else {
-    MOZ_ASSERT(obj->group() == group);
-  }
+  MOZ_ASSERT(obj->group() == group);
 #endif
 
   // If we're storing null/undefined to a typed object property, check if
   // we want to include it in this property's type information.
   bool addType = true;
   if (MOZ_UNLIKELY(obj->is<TypedObject>()) && value.isNullOrUndefined()) {
     StructTypeDescr* structDescr =
         &obj->as<TypedObject>().typeDescr().as<StructTypeDescr>();
@@ -2219,24 +2212,16 @@ bool DoSetElemFallback(JSContext* cx, Ba
   }
 
   RootedShape oldShape(cx, obj->maybeShape());
   RootedObjectGroup oldGroup(cx, JSObject::getGroup(cx, obj));
   if (!oldGroup) {
     return false;
   }
 
-  if (obj->is<UnboxedPlainObject>()) {
-    MOZ_ASSERT(!oldShape);
-    if (UnboxedExpandoObject* expando =
-            obj->as<UnboxedPlainObject>().maybeExpando()) {
-      oldShape = expando->lastProperty();
-    }
-  }
-
   bool isTemporarilyUnoptimizable = false;
   bool canAddSlot = false;
   bool attached = false;
 
   if (stub->state().maybeTransition()) {
     stub->discardStubs(cx);
   }
 
@@ -2383,35 +2368,16 @@ void ICScript::noteHasDenseAdd(uint32_t 
   ICFallbackStub* stub = entry.fallbackStub();
 
   if (stub->isSetElem_Fallback()) {
     stub->toSetElem_Fallback()->noteHasDenseAdd();
   }
 }
 
 template <typename T>
-void EmitICUnboxedPreBarrier(MacroAssembler& masm, const T& address,
-                             JSValueType type) {
-  if (type == JSVAL_TYPE_OBJECT) {
-    EmitPreBarrier(masm, address, MIRType::Object);
-  } else if (type == JSVAL_TYPE_STRING) {
-    EmitPreBarrier(masm, address, MIRType::String);
-  } else {
-    MOZ_ASSERT(!UnboxedTypeNeedsPreBarrier(type));
-  }
-}
-
-template void EmitICUnboxedPreBarrier(MacroAssembler& masm,
-                                      const Address& address, JSValueType type);
-
-template void EmitICUnboxedPreBarrier(MacroAssembler& masm,
-                                      const BaseIndex& address,
-                                      JSValueType type);
-
-template <typename T>
 void StoreToTypedArray(JSContext* cx, MacroAssembler& masm, Scalar::Type type,
                        const ValueOperand& value, const T& dest,
                        Register scratch, Label* failure) {
   Label done;
 
   if (type == Scalar::Float32 || type == Scalar::Float64) {
     masm.ensureDouble(value, FloatReg0, failure);
     if (type == Scalar::Float32) {
@@ -2963,24 +2929,16 @@ bool DoSetPropFallback(JSContext* cx, Ba
     return false;
   }
   RootedShape oldShape(cx, obj->maybeShape());
   RootedObjectGroup oldGroup(cx, JSObject::getGroup(cx, obj));
   if (!oldGroup) {
     return false;
   }
 
-  if (obj->is<UnboxedPlainObject>()) {
-    MOZ_ASSERT(!oldShape);
-    if (UnboxedExpandoObject* expando =
-            obj->as<UnboxedPlainObject>().maybeExpando()) {
-      oldShape = expando->lastProperty();
-    }
-  }
-
   // There are some reasons we can fail to attach a stub that are temporary.
   // We want to avoid calling noteUnoptimizableAccess() if the reason we
   // failed to attach a stub is one of those temporary reasons, since we might
   // end up attaching a stub for the exact same access later.
   bool isTemporarilyUnoptimizable = false;
   bool canAddSlot = false;
 
   bool attached = false;
@@ -3547,18 +3505,17 @@ static bool TryAttachCallStub(JSContext*
       JSObject* thisObject =
           CreateThisForFunction(cx, fun, newTarget, TenuredObject);
       if (!thisObject) {
         return false;
       }
 
       MOZ_ASSERT(thisObject->nonCCWRealm() == fun->realm());
 
-      if (thisObject->is<PlainObject>() ||
-          thisObject->is<UnboxedPlainObject>()) {
+      if (thisObject->is<PlainObject>()) {
         templateObject = thisObject;
       }
     }
 
     if (nativeWithJitEntry) {
       JitSpew(JitSpew_BaselineIC,
               "  Generating Call_Scripted stub (native=%p with jit entry, "
               "cons=%s, spread=%s)",
--- a/js/src/jit/BaselineIC.h
+++ b/js/src/jit/BaselineIC.h
@@ -16,17 +16,16 @@
 #include "jit/BaselineJIT.h"
 #include "jit/ICState.h"
 #include "jit/SharedICRegisters.h"
 #include "js/GCVector.h"
 #include "vm/ArrayObject.h"
 #include "vm/BytecodeUtil.h"
 #include "vm/JSContext.h"
 #include "vm/Realm.h"
-#include "vm/UnboxedObject.h"
 
 namespace js {
 namespace jit {
 
 // [SMDOC] JIT Inline Caches (ICs)
 //
 // Baseline Inline Caches are polymorphic caches that aggressively
 // share their stub code.
@@ -2707,20 +2706,16 @@ inline bool IsCacheableDOMProxy(JSObject
 
   // Some DOM proxies have dynamic prototypes.  We can't really cache those very
   // well.
   return obj->hasStaticPrototype();
 }
 
 struct IonOsrTempData;
 
-template <typename T>
-void EmitICUnboxedPreBarrier(MacroAssembler& masm, const T& address,
-                             JSValueType type);
-
 // Write an arbitrary value to a typed array or typed object address at dest.
 // If the value could not be converted to the appropriate format, jump to
 // failure.
 template <typename T>
 void StoreToTypedArray(JSContext* cx, MacroAssembler& masm, Scalar::Type type,
                        const ValueOperand& value, const T& dest,
                        Register scratch, Label* failure);
 
--- a/js/src/jit/IonIC.cpp
+++ b/js/src/jit/IonIC.cpp
@@ -259,23 +259,16 @@ bool IonSetPropertyIC::update(JSContext*
   }
 
   if (ic->state().canAttachStub()) {
     oldShape = obj->maybeShape();
     oldGroup = JSObject::getGroup(cx, obj);
     if (!oldGroup) {
       return false;
     }
-    if (obj->is<UnboxedPlainObject>()) {
-      MOZ_ASSERT(!oldShape);
-      if (UnboxedExpandoObject* expando =
-              obj->as<UnboxedPlainObject>().maybeExpando()) {
-        oldShape = expando->lastProperty();
-      }
-    }
 
     RootedValue objv(cx, ObjectValue(*obj));
     RootedScript script(cx, ic->script());
     jsbytecode* pc = ic->pc();
     SetPropIRGenerator gen(cx, script, pc, ic->kind(), ic->state().mode(),
                            &isTemporarilyUnoptimizable, &canAddSlot, objv,
                            idVal, rhs, ic->needsTypeBarrier(),
                            ic->guardHoles());
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -32,17 +32,16 @@
 #include "vm/SharedArrayObject.h"
 #include "vm/TypedArrayObject.h"
 #include "wasm/WasmInstance.h"
 
 #include "jit/shared/Lowering-shared-inl.h"
 #include "vm/JSScript-inl.h"
 #include "vm/NativeObject-inl.h"
 #include "vm/StringObject-inl.h"
-#include "vm/UnboxedObject-inl.h"
 
 using mozilla::ArrayLength;
 using mozilla::AssertedCast;
 using mozilla::Maybe;
 
 using JS::DoubleNaNValue;
 using JS::TrackedOutcome;
 
@@ -2937,18 +2936,17 @@ IonBuilder::InliningResult IonBuilder::i
     return InliningStatus_NotInlined;
   }
 
   // At this point we know we're going to inline this.
   callInfo.setImplicitlyUsedUnchecked();
 
   // Try to constant fold some common cases.
   if (const Class* knownClass = types->getKnownClass(constraints())) {
-    if (knownClass == &PlainObject::class_ ||
-        knownClass == &UnboxedPlainObject::class_) {
+    if (knownClass == &PlainObject::class_) {
       pushConstant(StringValue(names().objectObject));
       return InliningStatus_Inlined;
     }
     if (IsArrayClass(knownClass)) {
       pushConstant(StringValue(names().objectArray));
       return InliningStatus_Inlined;
     }
     if (knownClass == &JSFunction::class_) {
--- a/js/src/jit/OptimizationTracking.cpp
+++ b/js/src/jit/OptimizationTracking.cpp
@@ -7,21 +7,19 @@
 #include "jit/OptimizationTracking.h"
 
 #include "ds/Sort.h"
 #include "jit/IonBuilder.h"
 #include "jit/JitcodeMap.h"
 #include "jit/JitSpewer.h"
 #include "js/TrackedOptimizationInfo.h"
 #include "util/Text.h"
-#include "vm/UnboxedObject.h"
 
 #include "vm/ObjectGroup-inl.h"
 #include "vm/TypeInference-inl.h"
-#include "vm/UnboxedObject-inl.h"
 
 using namespace js;
 using namespace js::jit;
 
 using mozilla::Maybe;
 using mozilla::Nothing;
 using mozilla::Some;
 
@@ -784,19 +782,16 @@ static bool WriteOffsetsTable(CompactBuf
 
 static JSFunction* MaybeConstructorFromType(TypeSet::Type ty) {
   if (ty.isUnknown() || ty.isAnyObject() || !ty.isGroup()) {
     return nullptr;
   }
   ObjectGroup* obj = ty.group();
   AutoSweepObjectGroup sweep(obj);
   TypeNewScript* newScript = obj->newScript(sweep);
-  if (!newScript && obj->maybeUnboxedLayout(sweep)) {
-    newScript = obj->unboxedLayout(sweep).newScript();
-  }
   return newScript ? newScript->function() : nullptr;
 }
 
 static void InterpretedFunctionFilenameAndLineNumber(JSFunction* fun,
                                                      const char** filename,
                                                      Maybe<unsigned>* lineno) {
   if (fun->hasScript()) {
     *filename = fun->nonLazyScript()->maybeForwardedScriptSource()->filename();
--- a/js/src/jit/Recover.cpp
+++ b/js/src/jit/Recover.cpp
@@ -1446,51 +1446,22 @@ bool MObjectState::writeRecoverData(Comp
 
 RObjectState::RObjectState(CompactBufferReader& reader) {
   numSlots_ = reader.readUnsigned();
 }
 
 bool RObjectState::recover(JSContext* cx, SnapshotIterator& iter) const {
   RootedObject object(cx, &iter.read().toObject());
   RootedValue val(cx);
-
-  if (object->is<UnboxedPlainObject>()) {
-    const UnboxedLayout& layout = object->as<UnboxedPlainObject>().layout();
-
-    RootedId id(cx);
-    RootedValue receiver(cx, ObjectValue(*object));
-    const UnboxedLayout::PropertyVector& properties = layout.properties();
-    for (size_t i = 0; i < properties.length(); i++) {
-      val = iter.read();
-
-      // This is the default placeholder value of MObjectState, when no
-      // properties are defined yet.
-      if (val.isUndefined()) {
-        continue;
-      }
+  RootedNativeObject nativeObject(cx, &object->as<NativeObject>());
+  MOZ_ASSERT(nativeObject->slotSpan() == numSlots());
 
-      id = NameToId(properties[i].name);
-      ObjectOpResult result;
-
-      // SetProperty can only fail due to OOM.
-      if (!SetProperty(cx, object, id, val, receiver, result)) {
-        return false;
-      }
-      if (!result) {
-        return result.reportError(cx, object, id);
-      }
-    }
-  } else {
-    RootedNativeObject nativeObject(cx, &object->as<NativeObject>());
-    MOZ_ASSERT(nativeObject->slotSpan() == numSlots());
-
-    for (size_t i = 0; i < numSlots(); i++) {
-      val = iter.read();
-      nativeObject->setSlot(i, val);
-    }
+  for (size_t i = 0; i < numSlots(); i++) {
+    val = iter.read();
+    nativeObject->setSlot(i, val);
   }
 
   val.setObject(*object);
   iter.storeInstructionResult(val);
   return true;
 }
 
 bool MArrayState::writeRecoverData(CompactBufferWriter& writer) const {