From 54a59df1d09b2e5b3bb27f5a845dca9691318fc2 Mon Sep 17 00:00:00 2001 From: win7-7 Date: Mon, 5 Jan 2026 08:02:26 +0200 Subject: [PATCH] Further fixes Further fixes --- js/src/jit/MacroAssembler.cpp | 18 +++++++++ js/src/jit/MacroAssembler.h | 24 +++++++++++ js/src/jit/x64/MacroAssembler-x64.cpp | 2 +- js/src/jit/x86/MacroAssembler-x86.cpp | 57 ++++++++++++++++++++------- js/src/vm/String.cpp | 1 - js/src/vm/UnboxedObject.cpp | 4 +- 6 files changed, 88 insertions(+), 18 deletions(-) diff --git a/js/src/jit/MacroAssembler.cpp b/js/src/jit/MacroAssembler.cpp index 1be20c22b0..84cd5a0c79 100644 --- a/js/src/jit/MacroAssembler.cpp +++ b/js/src/jit/MacroAssembler.cpp @@ -31,6 +31,24 @@ using namespace js; using namespace js::jit; +template +void branchTestStringHelper(MacroAssembler& masm, Assembler::Condition cond, const T& src, Label* label) { + if constexpr (std::is_same_v) { + masm.branchTestString(cond, src, label); + } else { + // Address/BaseIndex must be wrapped in Operand for the x64 brancher + masm.branchTestString(cond, Operand(src), label); + } +} +template +void UnboxStringHelper(MacroAssembler* masm, const T& src, Register dest) { + if constexpr (std::is_same_v) { + masm->unboxString(src, dest); + } else { + masm->unboxString(Operand(src), dest); + } +} + using JS::GenericNaN; using JS::ToInt32; diff --git a/js/src/jit/MacroAssembler.h b/js/src/jit/MacroAssembler.h index 6ed7aae118..a6b11895cb 100644 --- a/js/src/jit/MacroAssembler.h +++ b/js/src/jit/MacroAssembler.h @@ -205,6 +205,30 @@ class MacroAssembler : public MacroAssemblerSpecific return this; } +public: +template +void branchTestStringHelper(Assembler::Condition cond, const T& src, Label* label) { + if constexpr (std::is_same_v) { + this->branchTestString(cond, src, label); + } else if constexpr (std::is_same_v) { + // Use the Address-specific path instead of wrapping in Operand + // This avoids the C2665 "cannot convert Operand" error + this->branchTest32(cond, src, Imm32(JSString::TYPE_FLAGS_MASK), label); + } else { + // Fallback for other types (like Register) + this->branchTestString(cond, src, label); + } +} + +template +void UnboxStringHelper(const T& src, Register dest) { + if constexpr (std::is_same_v) { + this->unboxString(src, dest); + } else { + this->unboxString(Operand(src), dest); + } +} + public: class AutoRooter : public JS::AutoGCRooter { diff --git a/js/src/jit/x64/MacroAssembler-x64.cpp b/js/src/jit/x64/MacroAssembler-x64.cpp index 9755d3a355..b963a1c187 100644 --- a/js/src/jit/x64/MacroAssembler-x64.cpp +++ b/js/src/jit/x64/MacroAssembler-x64.cpp @@ -614,7 +614,7 @@ MacroAssembler::branchValueIsNurseryCellImpl(Condition cond, const T& value, Reg branchTestObject(Assembler::Equal, tag, &checkObjectAddress); branchTestString(Assembler::NotEqual, tag, cond == Assembler::Equal ? &done : label); - unboxString(value, temp); + UnboxStringHelper(value, temp); jump(&checkAddress); bind(&checkObjectAddress); diff --git a/js/src/jit/x86/MacroAssembler-x86.cpp b/js/src/jit/x86/MacroAssembler-x86.cpp index 123c44c04b..c5f825b0b3 100644 --- a/js/src/jit/x86/MacroAssembler-x86.cpp +++ b/js/src/jit/x86/MacroAssembler-x86.cpp @@ -436,6 +436,15 @@ MacroAssembler::callWithABINoProfiler(const Address& fun, MoveOp::Type result) // =============================================================== // Branch functions +void +MacroAssembler::loadStoreBuffer(Register ptr, Register buffer) +{ + if (ptr != buffer) + movePtr(ptr, buffer); + orPtr(Imm32(gc::ChunkMask), buffer); + loadPtr(Address(buffer, gc::ChunkStoreBufferOffsetFromLastByte), buffer); +} + void MacroAssembler::branchPtrInNurseryChunk(Condition cond, Register ptr, Register temp, Label* label) @@ -465,20 +474,6 @@ MacroAssembler::branchPtrInNurseryChunkImpl(Condition cond, Register ptr, Label* Imm32(int32_t(gc::ChunkLocation::Nursery)), label); } -void -MacroAssembler::branchValueIsNurseryObject(Condition cond, const Address& address, Register temp, - Label* label) -{ - MOZ_ASSERT(cond == Assembler::Equal || cond == Assembler::NotEqual); - - Label done; - - branchTestObject(Assembler::NotEqual, address, cond == Assembler::Equal ? &done : label); - branchPtrInNurseryChunk(cond, address, temp, label); - - bind(&done); -} - void MacroAssembler::branchValueIsNurseryObject(Condition cond, ValueOperand value, Register temp, Label* label) @@ -493,6 +488,40 @@ MacroAssembler::branchValueIsNurseryObject(Condition cond, ValueOperand value, R bind(&done); } +void +MacroAssembler::branchValueIsNurseryCell(Condition cond, const Address& address, Register temp, + Label* label) +{ + MOZ_ASSERT(cond == Assembler::Equal || cond == Assembler::NotEqual); + Label done, checkAddress; + + Register tag = extractTag(address, temp); + MOZ_ASSERT(tag == temp); + branchTestObject(Assembler::Equal, tag, &checkAddress); + branchTestString(Assembler::NotEqual, tag, cond == Assembler::Equal ? &done : label); + + bind(&checkAddress); + branchPtrInNurseryChunk(cond, ToPayload(address), temp, label); + + bind(&done); +} + +void +MacroAssembler::branchValueIsNurseryCell(Condition cond, ValueOperand value, Register temp, + Label* label) +{ + MOZ_ASSERT(cond == Assembler::Equal || cond == Assembler::NotEqual); + Label done, checkAddress; + + branchTestObject(Assembler::Equal, value, &checkAddress); + branchTestString(Assembler::NotEqual, value, cond == Assembler::Equal ? &done : label); + + bind(&checkAddress); + branchPtrInNurseryChunk(cond, value.payloadReg(), temp, label); + + bind(&done); +} + void MacroAssembler::branchTestValue(Condition cond, const ValueOperand& lhs, const Value& rhs, Label* label) diff --git a/js/src/vm/String.cpp b/js/src/vm/String.cpp index b49863ec85..f5c717bfc0 100644 --- a/js/src/vm/String.cpp +++ b/js/src/vm/String.cpp @@ -488,7 +488,6 @@ JSRope::flattenInternal(ExclusiveContext* maybecx) } str->setNonInlineChars(wholeChars); pos = wholeChars + left.d.u1.length; - JS_STATIC_ASSERT(!(EXTENSIBLE_FLAGS & DEPENDENT_FLAGS)); left.d.u1.flags ^= (EXTENSIBLE_FLAGS | DEPENDENT_FLAGS); left.d.s.u3.base = (JSLinearString*)this; /* will be true on exit */ BarrierMethods::postBarrier((JSString**)&left.d.s.u3.base, nullptr, this); diff --git a/js/src/vm/UnboxedObject.cpp b/js/src/vm/UnboxedObject.cpp index f2f03f05f9..274e064a9f 100644 --- a/js/src/vm/UnboxedObject.cpp +++ b/js/src/vm/UnboxedObject.cpp @@ -149,8 +149,8 @@ UnboxedLayout::makeConstructorCode(JSContext* cx, HandleObjectGroup group) } else { MOZ_ASSERT(property.type == JSVAL_TYPE_STRING); Label notString; - masm.branchTestString(Assembler::NotEqual, valueAddress, ¬String); - masm.unboxString(valueAddress, scratch1); + masm.branchTestStringHelper(Assembler::NotEqual, valueAddress, ¬String); + masm.UnboxStringHelper(valueAddress, scratch1); masm.branchPtrInNurseryChunk(Assembler::Equal, scratch1, scratch2, &postBarrier); masm.bind(¬String); }