935032 - Remove remaining uses of JSContext in IonBuilder

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Brian Hackett [Laid off!]]

Except for the emergency repair added in bug 933734, the remaining uses of IonBuilder's context member are straightforward to remove.  Rather than file bugs for each of these separately this bug collates the various fixes required.

Comment 1

[Brian Hackett [Laid off!]]

Attachment: use linear searches of shapes in annotated property caches

annotateGetPropertyCache and getPropTryCache use a context to allow hashification of shapes which they are searching.  These shapes are not in a dictionary though and can be searched linearly from off thread.  (Dictionary shapes can't be searched linearly while off thread because their next/prev pointers might change).

Comment 2

[Brian Hackett [Laid off!]]

Attachment: remove context uses from ScopeCoordinate APIs

Several APIs for interacting with aliasedvar scope coordinates take a context, which is only used to construct an unnecessary root inside StaticScopeIters.  This patch makes StaticScopeIter a template class like Shape::Range which either does or doesn't require a context.

Comment 3

[Brian Hackett [Laid off!]]

Attachment: use Ion allocator for TypeRepresentationSet

This patch uses Ion's temp allocator for allocating the TypeRepresentationSet optionally created (fixing a leak in the process, since IonBuilders aren't explicitly destroyed).  TypeRepresentationSet doesn't release any other data in its destructor.

Comment 4

[Brian Hackett [Laid off!]]

Attachment: don't try to create the reg exp prototype

When compiling JSOP_REGEXP IonBuilder gets the RegExp prototype from the global, but this will never need to create this prototype lazily since there is a regexp literal whose prototype is the object being searched for.

Comment 5

[Brian Hackett [Laid off!]]

Attachment: PJS changes

Change inlining of PJS natives to not force instantiation of constructor intrinsic functions, and store the ParallelArrayObject template in baseline caches, as is done for other natives.

Comment 6

[Brian Hackett [Laid off!]]

Attachment: don't force instantiation of the math cache

The math cache will be instantiated the first time a math function is called so there is no need for IonBuilder to force its instantiation.

Comment 7

[Brian Hackett [Laid off!]]

Attachment: don't root for calls to ArrayPrototypeHasIndexedProperty

Remove an unnecessary Handle requirement on ArrayPrototypeHasIndexedProperty.

Comment 8

[Brian Hackett [Laid off!]]

Attachment: don't call a generic ToNumber when inlining Math.pow

ToNumber can have side effects and should never be called by IonBuilder.

Comment 9

[Shu-yu Guo [:shu]]

Comment on attachment 827446 [details] [diff] [review]
PJS changes

Review of attachment 827446 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good to me.

Comment 10

[Brian Hackett [Laid off!]]

Part A:

https://hg.mozilla.org/integration/mozilla-inbound/rev/3982cd8d5cd3

Comment 11

[Brian Hackett [Laid off!]]

Attachment: don't create template for intrinsic_NewDenseArray

Here's another intrinsic creating template objects which I missed yesterday.

Comment 12

[Brian Hackett [Laid off!]]

Part B:

https://hg.mozilla.org/integration/mozilla-inbound/rev/b90da019d6d2

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/3982cd8d5cd3

Comment 14

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/b90da019d6d2

Comment 15

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8196cbbcadcd

Comment 16

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/8196cbbcadcd