Optimise Object.prototype.toString in CacheIR and Warp
Categories
(Core :: JavaScript Engine: JIT, enhancement)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox86 | --- | fixed |
People
(Reporter: anba, Assigned: anba)
References
Details
Attachments
(4 files)
|
Assignee | |
Comment 1•4 years ago
|
||
Bug 1277801 missed to remove the class-name fallback from ObjectClassToString().
With the class-name fallback removed, ObjectClassToString() no longer allocates,
so we can also change it to an ABI call.
|
|
Assignee | |
Comment 2•4 years ago
|
||
With the class-name fallback removed, we can also change GetBuiltinTag{Fast,Slow}
to directly return "[object Object]".
Depends on D102132
|
|
Assignee | |
Comment 3•4 years ago
|
||
As a further simplification, GetBuiltinTagSlow() can additionally be changed
to return a JSString* instead of using an out-param.
Depends on D102133
|
|
Assignee | |
Comment 4•4 years ago
|
||
Changes js::ObjectClassToString() to return nullptr to mean that the object
has a @@toStringTag property or is a proxy.
MObjectClassToString had to be changed as follows:
- Needs to be marked as a "guard" instruction, so we don't incorrectly optimise
it away when we should instead bail out, e.g. when the object is a proxy. - The alias-set has to record that
js::ObjectClassToString()performs a lookup
for@@toStringTag. - Additionally added an override for
possiblyCalls()to notify LICM that this
instruction always performs a call.
Depends on D102134
|
||
Comment 6•4 years ago
|
||
| bugherder | ||
https://hg.mozilla.org/mozilla-central/rev/62dffeb550fc
https://hg.mozilla.org/mozilla-central/rev/b7e31120abe3
https://hg.mozilla.org/mozilla-central/rev/74a016fe3ce6
https://hg.mozilla.org/mozilla-central/rev/2ab1ab05fa2a
Description
•