Closed Bug 1687229 Opened 4 months ago Closed 4 months ago

Optimise Object.prototype.toString in CacheIR and Warp


(Core :: JavaScript Engine: JIT, enhancement)




86 Branch
Tracking Status
firefox86 --- fixed


(Reporter: anba, Assigned: anba)


(Blocks 1 open bug)



(4 files)

No description provided.

Bug 1277801 missed to remove the class-name fallback from ObjectClassToString().

With the class-name fallback removed, ObjectClassToString() no longer allocates,
so we can also change it to an ABI call.

With the class-name fallback removed, we can also change GetBuiltinTag{Fast,Slow}
to directly return "[object Object]".

Depends on D102132

As a further simplification, GetBuiltinTagSlow() can additionally be changed
to return a JSString* instead of using an out-param.

Depends on D102133

Changes js::ObjectClassToString() to return nullptr to mean that the object
has a @@toStringTag property or is a proxy.

MObjectClassToString had to be changed as follows:

  • Needs to be marked as a "guard" instruction, so we don't incorrectly optimise
    it away when we should instead bail out, e.g. when the object is a proxy.
  • The alias-set has to record that js::ObjectClassToString() performs a lookup
    for @@toStringTag.
  • Additionally added an override for possiblyCalls() to notify LICM that this
    instruction always performs a call.

Depends on D102134

Pushed by
Part 1: Remove class-name fallback from ObjectClassToString and change it to an ABI call. r=jandem
Part 2: Directly return '[object Object]' in GetBuiltinTag{Fast,Slow}. r=jandem
Part 3: Return a string from GetBuiltinTagSlow. r=jandem
Part 4: Optimise Object.prototype.toString in CacheIR and Warp. r=jandem
You need to log in before you can comment on or make changes to this bug.