1665227 - Warp: Support non-object prototypes in scripted constructors

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, task, P2)

Description

[Iain Ireland [:iain]]

In bug 1664357, to make it possible to inline constructors, we ensured that scripted constructor stubs can only attached when we have a template object (or are calling a constructor that expects to be passed JS_UNINITIALIZED_LEXICAL for this).

anba points out real-world cases where a null prototype is useful. We should optimize those too.

The cleanest way to do this is probably to wait until Ion is gone and we are no longer using MetaTwoByte for native template objects. At that point, we can replace the use of MetaTwoByte for scripted constructors with a field in CallScriptedFunction / CallInlinedFunction, and replace the isConstructing/needsUninitializedThis flags in CallFlags with a ConstructorKind enum class (with values None, TemplateObject, UninitializedThis, and VMCall).

Comment 1

[André Bargull [:anba]]

Attachment: Bug 1665227 - Part 1: Inline constructors with non-object prototypes. r=iain!

This follows the existing inlining support for constructors with an object
prototype, but instead of guarding that the prototype slot is a specific
object, the new operation guards that the prototype slot isn't an object.

Comment 2

[André Bargull [:anba]]

Attachment: Bug 1665227 - Part 2: Use the same allocation kind irrespective of the prototype type. r=iain!

This change ensures there's no surprising performance difference between:

function Klass() {
  this.prop = 0;
}

new Klass();

and:

function Klass() {
  this.prop = 0;
}
Klass.prototype = null;

new Klass();

In the first case, the created this object has AllocKind::OBJECT4, so
adding "prop" is writing to a fixed slot. Without this change, the second case
created an object with AllocKind::OBJECT0, which meant that adding "prop"
allocated a new dynamic slot.

Depends on D128378

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/37a13e4f61a2
Part 1: Inline constructors with non-object prototypes. r=iain
https://hg.mozilla.org/integration/autoland/rev/3adef16ca742
Part 2: Use the same allocation kind irrespective of the prototype type. r=iain

Comment 4

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/37a13e4f61a2
https://hg.mozilla.org/mozilla-central/rev/3adef16ca742