1631267 - Warp: Support CacheIR's LoadObject

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, task, P2)

Description

[Tom S]

LoadObject is used for example for guarding on properties on the prototype chain.
A simple version that just creates an MConstant for the JSObject* in LoadObject triggers nursery related assertions. We probably have to implement something like IonBuilder::checkNurseryObject, however that might not be possible off-thread.

Comment 1

[Jan de Mooij [:jandem]]

There's a TODO to check for nursery things in WarpOracle. I hope that will be good enough for now because the builtin prototypes are tenured...

If we wanted to support this, I think the best approach is to store a list/set of nursery objects in the snapshot, copy it to the IonScript and then have JIT code load from that instead of baking nursery objects in the code. I don't really like the mechanism IonBuilder has for this.

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Bug 1631267 part 1 - Support LoadObject in the transpiler. r?iain!

We don't transpile CacheIR if the stub data contains nursery pointers. We will
probably need to support that at some point, but this lets us improve our
coverage for now.

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Bug 1631267 part 2 - Create MapIteratorProto, SetIteratorProto, FinalizationIteratorProto as singletons. r?jwalden!

While working on the previous patch I noticed some builtin prototypes weren't tenured.

Use createBlankPrototypeInheriting for consistency with similar code elsewhere.

Depends on D73221

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/437e68411565
part 1 - Support LoadObject in the transpiler. r=iain
https://hg.mozilla.org/integration/autoland/rev/66899ba0dcbe
part 2 - Create MapIteratorProto, SetIteratorProto, FinalizationIteratorProto as singletons. r=jwalden

Comment 5

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/437e68411565
https://hg.mozilla.org/mozilla-central/rev/66899ba0dcbe