The Tor Browser: js/src/vm/PIC.h@b8a032363ba2 (annotated)

js/src/vm/PIC.h@b8a032363ba2 (annotated)

js/src/vm/PIC.h

Thu, 22 Jan 2015 13:21:57 +0100

author: Michael Schloh von Bennewitz <michael@schloh.com>
date: Thu, 22 Jan 2015 13:21:57 +0100
branch: TOR_BUG_9701
changeset 15: b8a032363ba2
permissions: -rw-r--r--

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #ifndef vm_PIC_h
 #define vm_PIC_h
 #include "jsapi.h"
 #include "jscntxt.h"
 #include "jsfriendapi.h"
 #include "jsobj.h"
 #include "gc/Barrier.h"
 #include "gc/Heap.h"
 #include "gc/Marking.h"
 #include "js/Value.h"
 #include "vm/GlobalObject.h"
 namespace js {
 class Shape;
 template <typename Category> class PICChain;
 /*
  * The basic PICStub just has a pointer to the next stub.
  */
 template <typename Category>
 class PICStub
 {
   friend class PICChain<Category>;
   private:
     typedef typename Category::Stub CatStub;
     typedef typename Category::Chain CatChain;
   protected:
     CatStub *next_;
     PICStub() : next_(nullptr) {}
     PICStub(const CatStub *next) : next_(next) {
         JS_ASSERT(next_);
     }
     PICStub(const CatStub &other) : next_(other.next_) {}
   public:
     CatStub *next() const {
         return next_;
     }
   protected:
     void append(CatStub *stub) {
         JS_ASSERT(!next_);
         JS_ASSERT(!stub->next_);
         next_ = stub;
     }
 };
 /*
  * The basic PIC just has a pointer to the list of stubs.
  */
 template <typename Category>
 class PICChain
 {
   private:
     typedef typename Category::Stub CatStub;
     typedef typename Category::Chain CatChain;
   protected:
     CatStub *stubs_;
     PICChain() : stubs_(nullptr) {}
     // PICs should never be copy constructed.
     PICChain(const PICChain<Category> &other) MOZ_DELETE;
   public:
     CatStub *stubs() const {
         return stubs_;
     }
     void addStub(CatStub *stub) {
         JS_ASSERT(stub);
         JS_ASSERT(!stub->next());
         if (!stubs_) {
             stubs_ = stub;
             return;
         }
         CatStub *cur = stubs_;
         while (cur->next())
             cur = cur->next();
         cur->append(stub);
     }
     unsigned numStubs() const {
         unsigned count = 0;
         for (CatStub *stub = stubs_; stub; stub = stub->next())
             count++;
         return count;
     }
     void removeStub(CatStub *stub, CatStub *previous) {
         if (previous) {
             JS_ASSERT(previous->next() == stub);
             previous->next_ = stub->next();
         } else {
             JS_ASSERT(stub == stubs_);
             stubs_ = stub->next();
         }
         js_delete(stub);
     }
 };
 /*
  *  ForOfPIC defines a PIC category for optimizing for-of operations.
  */
 struct ForOfPIC
 {
     /* Forward declarations so template-substitution works. */
     class Stub;
     class Chain;
     ForOfPIC() MOZ_DELETE;
     ForOfPIC(const ForOfPIC &other) MOZ_DELETE;
     typedef PICStub<ForOfPIC> BaseStub;
     typedef PICChain<ForOfPIC> BaseChain;
     /*
      * A ForOfPIC has only one kind of stub for now: one that holds the shape
      * of an array object that does not override its '@@iterator' property.
      */
     class Stub : public BaseStub
     {
       private:
         // Shape of matching array object.
         Shape *shape_;
       public:
         Stub(Shape *shape)
           : BaseStub(),
             shape_(shape)
         {
             JS_ASSERT(shape_);
         }
         Shape *shape() {
             return shape_;
         }
     };
     /*
      * A ForOfPIC chain holds the following:
      *
      *  Array.prototype (arrayProto_)
      *      To ensure that the incoming array has the standard proto.
      *
      *  Array.prototype's shape (arrayProtoShape_)
      *      To ensure that Array.prototype has not been modified.
      *
      *  ArrayIterator.prototype (arrayIteratorProto_)
      *  ArrayIterator.prototype's shape (arrayIteratorProtoShape_)
      *      To ensure that an ArrayIterator.prototype has not been modified.
      *
      *  Array.prototype's slot number for '@@iterator' (arrayProtoIteratorSlot_)
      *  Array.prototype's canonical value for '@@iterator' (canonicalIteratorFunc_)
      *      To quickly retreive and ensure that the iterator constructor
      *      stored in the slot has not changed.
      *
      *  ArrayIterator.prototype's slot number for 'next' (arrayIteratorProtoNextSlot_)
      *  ArrayIterator.prototype's canonical value for 'next' (canonicalNextFunc_)
      *      To quickly retreive and ensure that the 'next' method for ArrayIterator
      *      objects has not changed.
      */
     class Chain : public BaseChain
     {
       private:
         // Pointer to canonical Array.prototype and ArrayIterator.prototype
         HeapPtrObject arrayProto_;
         HeapPtrObject arrayIteratorProto_;
         // Shape of matching Array.prototype object, and slot containing
         // the '@@iterator' for it, and the canonical value.
         HeapPtrShape arrayProtoShape_;
         uint32_t arrayProtoIteratorSlot_;
         HeapValue canonicalIteratorFunc_;
         // Shape of matching ArrayIteratorProto, and slot containing
         // the 'next' property, and the canonical value.
         HeapPtrShape arrayIteratorProtoShape_;
         uint32_t arrayIteratorProtoNextSlot_;
         HeapValue canonicalNextFunc_;
         // Initialization flag marking lazy initialization of above fields.
         bool initialized_;
         // Disabled flag is set when we don't want to try optimizing anymore
         // because core objects were changed.
         bool disabled_;
         static const unsigned MAX_STUBS = 10;
       public:
         Chain()
           : BaseChain(),
             arrayProto_(nullptr),
             arrayIteratorProto_(nullptr),
             arrayProtoShape_(nullptr),
             arrayProtoIteratorSlot_(-1),
             canonicalIteratorFunc_(UndefinedValue()),
             arrayIteratorProtoShape_(nullptr),
             arrayIteratorProtoNextSlot_(-1),
             initialized_(false),
             disabled_(false)
         {}
         // Initialize the canonical iterator function.
         bool initialize(JSContext *cx);
         // Check if a given array object is optimized by this PIC.
         Stub *isArrayOptimized(ArrayObject *obj);
         // Try to optimize this chain for an object.
         bool tryOptimizeArray(JSContext *cx, HandleObject array, bool *optimized);
         // Check if the global array-related objects have not been messed with
         // in a way that would disable this PIC.
         bool isArrayStateStillSane();
         // Check if ArrayIterator.next is still optimizable.
         inline bool isArrayNextStillSane() {
             return (arrayIteratorProto_->lastProperty() == arrayIteratorProtoShape_) &&
                 (arrayIteratorProto_->getSlot(arrayIteratorProtoNextSlot_) == canonicalNextFunc_);
         }
         void mark(JSTracer *trc);
         void sweep(FreeOp *fop);
       private:
         // Get a matching optimized stub for the given object.
         Stub *getMatchingStub(JSObject *obj);
         // Check if the given object is for-of optimizable with this PIC.
         bool isOptimizableArray(JSObject *obj);
         // Reset the PIC and all info associated with it.
         void reset(JSContext *cx);
         // Erase the stub chain.
         void eraseChain();
     };
     // Class for object that holds ForOfPIC chain.
     static const Class jsclass;
     static JSObject *createForOfPICObject(JSContext *cx, Handle<GlobalObject *> global);
     static inline Chain *fromJSObject(JSObject *obj) {
         JS_ASSERT(js::GetObjectClass(obj) == &ForOfPIC::jsclass);
         return (ForOfPIC::Chain *) obj->getPrivate();
     }
     static inline Chain *getOrCreate(JSContext *cx) {
         JSObject *obj = cx->global()->getForOfPICObject();
         if (obj)
             return fromJSObject(obj);
         return create(cx);
     }
     static Chain *create(JSContext *cx);
 };
 } // namespace js
 #endif /* vm_PIC_h */

The Tor Browser / annotate

js/src/vm/PIC.h@b8a032363ba2 (annotated)

js/src/vm/PIC.h