From 3eb7729d04564b94c13e376782842dd969ff3650 Mon Sep 17 00:00:00 2001 From: Martok Date: Thu, 13 Jul 2023 02:37:07 +0200 Subject: [PATCH] Issue #2271 - Separate cloning of native and interpreted functions Separate code paths make it easier to follow and specialize than a single one-size-fits-all function. Based-on: m-c 1405766, 1411954 --- js/src/jsapi.cpp | 23 +++------- js/src/jsfun.cpp | 94 ++++++++++++++++++++++++++------------- js/src/jsfun.h | 6 +++ js/src/vm/Interpreter.cpp | 8 +++- js/src/vm/SelfHosting.cpp | 38 +++++++++------- js/src/wasm/AsmJS.cpp | 4 +- js/src/wasm/AsmJS.h | 3 ++ 7 files changed, 108 insertions(+), 68 deletions(-) diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp index 9e5853b454..0e29f02176 100644 --- a/js/src/jsapi.cpp +++ b/js/src/jsapi.cpp @@ -3530,9 +3530,6 @@ CreateNonSyntacticEnvironmentChain(JSContext* cx, AutoObjectVector& envChain, static bool IsFunctionCloneable(HandleFunction fun) { - if (!fun->isInterpreted()) - return true; - // If a function was compiled with non-global syntactic environments on // the environment chain, we could have baked in EnvironmentCoordinates // into the script. We cannot clone it without breaking the compiler's @@ -3570,6 +3567,11 @@ CloneFunctionObject(JSContext* cx, HandleObject funobj, HandleObject env, Handle return nullptr; } + if (fun->isNative()) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_CANT_CLONE_OBJECT); + return nullptr; + } + if (!IsFunctionCloneable(fun)) { JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_BAD_CLONE_FUNOBJ_SCOPE); return nullptr; @@ -3580,21 +3582,6 @@ CloneFunctionObject(JSContext* cx, HandleObject funobj, HandleObject env, Handle return nullptr; } - if (IsAsmJSModule(fun)) { - JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_CANT_CLONE_OBJECT); - return nullptr; - } - - if (IsWrappedAsyncFunction(fun)) { - JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_CANT_CLONE_OBJECT); - return nullptr; - } - - if (IsWrappedAsyncGenerator(fun)) { - JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_CANT_CLONE_OBJECT); - return nullptr; - } - if (CanReuseScriptForClone(cx->compartment(), fun, env)) { // If the script is to be reused, either the script can already handle // non-syntactic scopes, or there is only the standard global lexical diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp index 67df78c2f1..bd133b822e 100644 --- a/js/src/jsfun.cpp +++ b/js/src/jsfun.cpp @@ -50,6 +50,7 @@ #include "vm/StringBuffer.h" #include "vm/WrapperObject.h" #include "vm/Xdr.h" +#include "wasm/AsmJS.h" #include "jsscriptinlines.h" @@ -2026,6 +2027,8 @@ bool js::CanReuseScriptForClone(JSCompartment* compartment, HandleFunction fun, HandleObject newParent) { + MOZ_ASSERT(fun->isInterpreted()); + if (compartment != fun->compartment() || fun->isSingleton() || ObjectGroup::useSingletonForClone(fun)) @@ -2044,12 +2047,11 @@ js::CanReuseScriptForClone(JSCompartment* compartment, HandleFunction fun, if (IsSyntacticEnvironment(newParent)) return true; - // We need to clone the script if we're interpreted and not already marked - // as having a non-syntactic scope. If we're lazy, go ahead and clone the - // script; see the big comment at the end of CopyScriptInternal for the - // explanation of what's going on there. - return !fun->isInterpreted() || - (fun->hasScript() && fun->nonLazyScript()->hasNonSyntacticScope()); + // We need to clone the script if we're not already marked as having a + // non-syntactic scope. If we're lazy, go ahead and clone the script; see + // the big comment at the end of CopyScriptInternal for the explanation of + // what's going on there. + return fun->hasScript() && fun->nonLazyScript()->hasNonSyntacticScope(); } static inline JSFunction* @@ -2096,6 +2098,7 @@ js::CloneFunctionReuseScript(JSContext* cx, HandleFunction fun, HandleObject enc HandleObject proto /* = nullptr */) { MOZ_ASSERT(NewFunctionEnvironmentIsWellFormed(cx, enclosingEnv)); + MOZ_ASSERT(fun->isInterpreted()); MOZ_ASSERT(!fun->isBoundFunction()); MOZ_ASSERT(CanReuseScriptForClone(cx->compartment(), fun, enclosingEnv)); @@ -2106,13 +2109,12 @@ js::CloneFunctionReuseScript(JSContext* cx, HandleFunction fun, HandleObject enc if (fun->hasScript()) { clone->initScript(fun->nonLazyScript()); clone->initEnvironment(enclosingEnv); - } else if (fun->isInterpretedLazy()) { + } else { + MOZ_ASSERT(fun->isInterpretedLazy()); MOZ_ASSERT(fun->compartment() == clone->compartment()); LazyScript* lazy = fun->lazyScriptOrNull(); clone->initLazyScript(lazy); clone->initEnvironment(enclosingEnv); - } else { - clone->initNative(fun->native(), fun->jitInfo()); } /* @@ -2130,25 +2132,19 @@ js::CloneFunctionAndScript(JSContext* cx, HandleFunction fun, HandleObject enclo HandleObject proto /* = nullptr */) { MOZ_ASSERT(NewFunctionEnvironmentIsWellFormed(cx, enclosingEnv)); + MOZ_ASSERT(fun->isInterpreted()); MOZ_ASSERT(!fun->isBoundFunction()); - JSScript::AutoDelazify funScript(cx); - if (fun->isInterpreted()) { - funScript = fun; - if (!funScript) - return nullptr; - } + JSScript::AutoDelazify funScript(cx, fun); + if (!funScript) + return nullptr; RootedFunction clone(cx, NewFunctionClone(cx, fun, SingletonObject, allocKind, proto)); if (!clone) return nullptr; - if (fun->hasScript()) { - clone->initScript(nullptr); - clone->initEnvironment(enclosingEnv); - } else { - clone->initNative(fun->native(), fun->jitInfo()); - } + clone->initScript(nullptr); + clone->initEnvironment(enclosingEnv); /* * Across compartments or if we have to introduce a non-syntactic scope we @@ -2165,21 +2161,57 @@ js::CloneFunctionAndScript(JSContext* cx, HandleFunction fun, HandleObject enclo newScope->hasOnChain(ScopeKind::NonSyntactic)); #endif - if (clone->isInterpreted()) { - RootedScript script(cx, fun->nonLazyScript()); - MOZ_ASSERT(script->compartment() == fun->compartment()); - MOZ_ASSERT(cx->compartment() == clone->compartment(), - "Otherwise we could relazify clone below!"); + RootedScript script(cx, fun->nonLazyScript()); + MOZ_ASSERT(script->compartment() == fun->compartment()); + MOZ_ASSERT(cx->compartment() == clone->compartment(), + "Otherwise we could relazify clone below!"); - RootedScript clonedScript(cx, CloneScriptIntoFunction(cx, newScope, clone, script)); - if (!clonedScript) - return nullptr; - Debugger::onNewScript(cx, clonedScript); - } + RootedScript clonedScript(cx, CloneScriptIntoFunction(cx, newScope, clone, script)); + if (!clonedScript) + return nullptr; + Debugger::onNewScript(cx, clonedScript); return clone; } +JSFunction* +js::CloneAsmJSModuleFunction(JSContext* cx, HandleFunction fun) +{ + MOZ_ASSERT(fun->isNative()); + MOZ_ASSERT(IsAsmJSModule(fun)); + MOZ_ASSERT(fun->isExtended()); + MOZ_ASSERT(cx->compartment() == fun->compartment()); + + JSFunction* clone = NewFunctionClone(cx, fun, GenericObject, AllocKind::FUNCTION_EXTENDED, + /* proto = */ nullptr); + if (!clone) + return nullptr; + + MOZ_ASSERT(fun->native() == InstantiateAsmJS); + MOZ_ASSERT(!fun->jitInfo()); + clone->initNative(InstantiateAsmJS, nullptr); + + clone->setGroup(fun->group()); + return clone; +} + +JSFunction* +js::CloneSelfHostingIntrinsic(JSContext* cx, HandleFunction fun) +{ + MOZ_ASSERT(fun->isNative()); + MOZ_ASSERT(fun->compartment()->isSelfHosting); + MOZ_ASSERT(!fun->isExtended()); + MOZ_ASSERT(cx->compartment() != fun->compartment()); + + JSFunction* clone = NewFunctionClone(cx, fun, SingletonObject, AllocKind::FUNCTION, + /* proto = */ nullptr); + if (!clone) + return nullptr; + + clone->initNative(fun->native(), fun->jitInfo()); + return clone; +} + /* * Return an atom for use as the name of a builtin method with the given * property id. diff --git a/js/src/jsfun.h b/js/src/jsfun.h index 1833aaeea5..49aac71654 100644 --- a/js/src/jsfun.h +++ b/js/src/jsfun.h @@ -824,6 +824,12 @@ CloneFunctionAndScript(JSContext* cx, HandleFunction fun, HandleObject parent, gc::AllocKind kind = gc::AllocKind::FUNCTION, HandleObject proto = nullptr); +extern JSFunction* +CloneAsmJSModuleFunction(JSContext* cx, HandleFunction fun); + +extern JSFunction* +CloneSelfHostingIntrinsic(JSContext* cx, HandleFunction fun); + } // namespace js inline js::FunctionExtended* diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp index d7c1b8e84a..3515a9336b 100644 --- a/js/src/vm/Interpreter.cpp +++ b/js/src/vm/Interpreter.cpp @@ -4302,7 +4302,13 @@ js::Lambda(JSContext* cx, HandleFunction fun, HandleObject parent) { MOZ_ASSERT(!fun->isArrow()); - RootedObject clone(cx, CloneFunctionObjectIfNotSingleton(cx, fun, parent)); + JSFunction* clone; + if (fun->isNative()) { + MOZ_ASSERT(IsAsmJSModule(fun)); + clone = CloneAsmJSModuleFunction(cx, fun); + } else { + clone = CloneFunctionObjectIfNotSingleton(cx, fun, parent); + } if (!clone) return nullptr; diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp index 357e151bde..c1276f5a43 100644 --- a/js/src/vm/SelfHosting.cpp +++ b/js/src/vm/SelfHosting.cpp @@ -2909,23 +2909,29 @@ CloneObject(JSContext* cx, HandleNativeObject selfHostedObject) RootedObject clone(cx); if (selfHostedObject->is()) { RootedFunction selfHostedFunction(cx, &selfHostedObject->as()); - bool hasName = selfHostedFunction->explicitName() != nullptr; + if (selfHostedFunction->isInterpreted()) { + bool hasName = selfHostedFunction->explicitName() != nullptr; - // Arrow functions use the first extended slot for their lexical |this| value. - MOZ_ASSERT(!selfHostedFunction->isArrow()); - js::gc::AllocKind kind = hasName - ? gc::AllocKind::FUNCTION_EXTENDED - : selfHostedFunction->getAllocKind(); - MOZ_ASSERT(!CanReuseScriptForClone(cx->compartment(), selfHostedFunction, cx->global())); - Rooted globalLexical(cx, &cx->global()->lexicalEnvironment()); - RootedScope emptyGlobalScope(cx, &cx->global()->emptyGlobalScope()); - clone = CloneFunctionAndScript(cx, selfHostedFunction, globalLexical, emptyGlobalScope, - kind); - // To be able to re-lazify the cloned function, its name in the - // self-hosting compartment has to be stored on the clone. - if (clone && hasName) { - clone->as().setExtendedSlot(LAZY_FUNCTION_NAME_SLOT, - StringValue(selfHostedFunction->explicitName())); + // Arrow functions use the first extended slot for their lexical |this| value. + MOZ_ASSERT(!selfHostedFunction->isArrow()); + js::gc::AllocKind kind = hasName + ? gc::AllocKind::FUNCTION_EXTENDED + : selfHostedFunction->getAllocKind(); + + Handle global = cx->global(); + Rooted globalLexical(cx, &global->lexicalEnvironment()); + RootedScope emptyGlobalScope(cx, &global->emptyGlobalScope()); + MOZ_ASSERT(!CanReuseScriptForClone(cx->compartment(), selfHostedFunction, global)); + clone = CloneFunctionAndScript(cx, selfHostedFunction, globalLexical, emptyGlobalScope, + kind); + // To be able to re-lazify the cloned function, its name in the + // self-hosting compartment has to be stored on the clone. + if (clone && hasName) { + clone->as().setExtendedSlot(LAZY_FUNCTION_NAME_SLOT, + StringValue(selfHostedFunction->explicitName())); + } + } else { + clone = CloneSelfHostingIntrinsic(cx, selfHostedFunction); } } else if (selfHostedObject->is()) { RegExpObject& reobj = selfHostedObject->as(); diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp index a56d4a3830..534fc5f699 100644 --- a/js/src/wasm/AsmJS.cpp +++ b/js/src/wasm/AsmJS.cpp @@ -8100,8 +8100,8 @@ AsmJSModuleFunctionToModule(JSFunction* fun) } // Implements the semantics of an asm.js module function that has been successfully validated. -static bool -InstantiateAsmJS(JSContext* cx, unsigned argc, JS::Value* vp) +bool +js::InstantiateAsmJS(JSContext* cx, unsigned argc, JS::Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); diff --git a/js/src/wasm/AsmJS.h b/js/src/wasm/AsmJS.h index a38b204a8b..296617c79b 100644 --- a/js/src/wasm/AsmJS.h +++ b/js/src/wasm/AsmJS.h @@ -56,6 +56,9 @@ IsAsmJSFunction(JSFunction* fun); extern bool IsAsmJSStrictModeModuleOrFunction(JSFunction* fun); +extern bool +InstantiateAsmJS(JSContext* cx, unsigned argc, JS::Value* vp); + // asm.js testing natives: extern bool