Closed Bug 1665348 Opened 3 years ago Closed 3 years ago

Warp: Transpile LoadArgumentsObjectArgResult, LoadArgumentsObjectLengthResult, and LoadFunctionLengthResult


(Core :: JavaScript Engine: JIT, task, P2)




82 Branch
Tracking Status
firefox82 --- fixed


(Reporter: anba, Assigned: anba)


(Blocks 1 open bug)



(8 files)

No description provided.

Don't attach LoadArgumentsObjectArgResult when it will fail anyway. The checks mirror
the dynamic checks from CacheIRCompiler.

Add MacroAssembler::loadArgumentsObjectElement in preparation for the next

Uses the same alias set as MGetArgumentsObjectArg. A more narrow alias set
may be possible, but we need to be sure not to run into any issues with mapped

Depends on D90403

Add in preparation for the next part.

Depends on D90404

This avoids calling LookupPropertyPure unless the property name is actually "length".

Depends on D90406

No self-hosted code reads BOUND_FUN_LENGTH_SLOT, so we might as well move it
to the other constants in FunctionExtended.

Drive-by fix:

  • Use fallibleUnboxInt32 in MacroAssembler::loadFunctionLength().

Depends on D90407

Also change CacheIR to not attach the stub if it will fail.

Depends on D90408

Severity: -- → N/A
Priority: -- → P2
Pushed by
Part 1: Don't attach LoadArgumentsObjectArgResult when it will fail. r=jandem
Part 2: Add MacroAssembler::loadArgumentsObjectElement. r=jandem
Part 3: Transpile LoadArgumentsObjectArgResult. r=jandem
Part 4: Add MacroAssembler::loadArgumentsObjectLength. r=jandem
Part 5: Transpile LoadArgumentsObjectLengthResult. r=jandem
Part 6: Check property name before the lookup when trying to attach FunctionLength. r=jandem
Part 7: Move bound-function length slot constant into FunctionExtended. r=jandem
Part 8: Transpile LoadFunctionLengthResult. r=jandem
You need to log in before you can comment on or make changes to this bug.