1545278 - Programatically restrict the types of objects that may JS_TransplantObject

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, enhancement, P3)

Description

[Ted Campbell [:tcampbell]]

So-called "brain transplants" are a thorn in the side of the JITs that can restrict optimizations or introduce bugs. In practice, we use these for very specialized use-cases (eg. Document.adoptNode and WindowProxy navigation). We should add a js::ObjectMayBeSwapped() helper that JSObject::swap will check as well as an JIT optimizations that that rely on the absence of swapping. This has the effect of documenting the places in the JITs that would like to ignore transplants in order to achieve simplicity or performance.

Comment 1

[Ted Campbell [:tcampbell]]

Attachment: Bug 1545278 - Add js::ObjectMayBeSwapped and restrict transplanting. r?iain

JS_TransplantObject is a very powerful API that results in the JITs
having to worry about the type of objects changing in surprising ways.
In practice though, there are very limited uses of this API so we can
add an API to determine which objects have to worry about transplanting.
This can then by asserted in JITs to document places that optimize
performance by expecting not to deal with transplants.

Comment 2

[Ted Campbell [:tcampbell]]

Attachment: Bug 1545278 - Assert places in JIT that do not tolerate transplants. r?iain

Before the JIT assumes that an object with the same pointer identity
will have the same immutable state it did last time, we now assert
!js::ObjectMayBeSwapped.

Also add CacheIR helpers to better classify different reasons for using
guardSpecificObject.

Depends on D27975

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0385c65eab37
Add js::ObjectMayBeSwapped and restrict transplanting. r=iain

Comment 4

[Oana Pop-Rus]

https://hg.mozilla.org/mozilla-central/rev/0385c65eab37

Comment 5

[Ted Campbell [:tcampbell]]

(I forgot to set leave-open. The part two patch needs some work, but something similar is still worth landing)

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:tcampbell, maybe it's time to close this bug?

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:tcampbell, maybe it's time to close this bug?

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:tcampbell, maybe it's time to close this bug?

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:tcampbell, maybe it's time to close this bug?

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:tcampbell, maybe it's time to close this bug?
For more information, please visit auto_nag documentation.