Closed Bug 1527843 Opened 9 months ago Closed 9 months ago

Make IonBuilder::createThis work for cross-realm functions

Categories

(Core :: JavaScript Engine: JIT, enhancement, P1)

enhancement

Tracking

()

RESOLVED FIXED
mozilla67
Tracking Status
firefox67 --- fixed

People

(Reporter: jandem, Assigned: jandem)

References

Details

Attachments

(1 file)

IonBuilder::createThis is used to create the |this| object for constructor calls in Ion. It takes the slow-path for cross-realm functions but it's not too hard to fix this now that everything else works.

It improves the micro-benchmark below (first number is for the Array constructor, second is a scripted function):

before: 107 ms / 93 ms
after:   95 ms /  9 ms

Of course this is all relative: with --more-compartments both take 600 ms :)


function f1() {
    var g = newGlobal();
    var t = new Date;
    for (var i = 0; i < 1000000; i++) {
        arr = new g.Array();
    }
    print(new Date - t);
}
f1();

function f2() {
    var g = newGlobal();
    g.evaluate("function Foo(x) { this.x = x; }");
    var t = new Date;
    for (var i = 0; i < 1000000; i++) {
        obj = new g.Foo(i);
    }
    print(new Date - t);
}
f2();

This has some minor fixes to ensure we create the object in the callee's realm
for MCreateThisWithTemplate and MCreateThisWithProto. It also fixes Baseline to
actually create a template object for Ion for cross-realm calls.

Some of the same-realm assertions I added may be redundant, but bugs in this area would be tricky to track down so better safe than sorry.

Priority: -- → P1
Pushed by jdemooij@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/16ad89a4e425
Don't take the slow path for cross-realm functions in IonBuilder::createThis. r=anba
Status: ASSIGNED → RESOLVED
Closed: 9 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla67
You need to log in before you can comment on or make changes to this bug.