Clean up shape teleporting a bit more
Categories
(Core :: JavaScript Engine, task, P3)
Tracking
()
Tracking | Status | |
---|---|---|
firefox88 | --- | fixed |
People
(Reporter: jandem, Assigned: jandem)
References
Details
Attachments
(6 files)
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review | |
48 bytes,
text/x-phabricator-request
|
Details | Review |
Assignee | ||
Comment 1•4 years ago
|
||
This goes back to when shape teleporting was used for environment chains too.
See also bug 1608034 where we made this change for (other) environment objects.
The global has a lot of properties and this avoids doing unnecessary work to
invalidate teleporting.
Add Object.prototype to the test-JSObject GDB test so that we still have a test for
the delegate flag.
Assignee | ||
Comment 2•4 years ago
|
||
This goes back to bug 787856 but dynamic prototypes don't need to be marked as
delegate, because shape teleporting and JITs don't optimize those prototype chains.
Other proxy handlers such as ScriptedProxyHandler, ForwardingProxyHandler, Xrays
don't do this so this is also more consistent.
Depends on D107416
Assignee | ||
Comment 3•4 years ago
|
||
Eagerly marking prototypes as delegate resulted in a lot of unnecessary shadowing
checks and reshaping when initializing the properties of those objects. This is
a regression from bug 724768.
It's more efficient, simpler, and consistent with JS-defined objects to mark
objects as delegate when they become the prototype of another object.
This removes the check for delegates in EmptyShape::ensureInitialCustomShape. That
should be fine because the only object it applies to is String.prototype and it
doesn't affect correctness. (RegExp and Error prototypes are plain objects since
bug 1213341 and bug 1192038 so don't show up there anyway.)
Depends on D107417
Assignee | ||
Comment 4•4 years ago
|
||
We already peeled off the receiver for non-delegates (= most objects) but we can
do this for delegates too.
Depends on D107418
Assignee | ||
Comment 5•4 years ago
|
||
This was used to ensure no cross-compartment objects were embedded by
ShapeGuardProtoChain (used for the property-not-found case) but that's no longer
an issue because ShapeGuardProtoChain only does shape guards now.
Depends on D107419
Assignee | ||
Comment 6•4 years ago
|
||
Depends on D107420
Updated•4 years ago
|
Comment 8•4 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/e7d5c30051f1
https://hg.mozilla.org/mozilla-central/rev/18b53abc9c5c
https://hg.mozilla.org/mozilla-central/rev/5081e5168c62
https://hg.mozilla.org/mozilla-central/rev/5966b61fe981
https://hg.mozilla.org/mozilla-central/rev/e09bd565aefc
https://hg.mozilla.org/mozilla-central/rev/a35d192bfe25
Description
•