From f57bf9f4d57d8e3ace521287f71880f79b29c49a Mon Sep 17 00:00:00 2001 From: win7-7 Date: Sat, 10 Jan 2026 20:43:04 +0200 Subject: [PATCH] Fixes. Fixes. --- js/src/jit/CodeGenerator.cpp | 80 ++++++++++++++++++++++++++++++----- js/src/jit/IonBuilder.cpp | 2 +- js/src/jit/MacroAssembler.cpp | 1 + 3 files changed, 72 insertions(+), 11 deletions(-) diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp index f863806cec..b6827c5349 100644 --- a/js/src/jit/CodeGenerator.cpp +++ b/js/src/jit/CodeGenerator.cpp @@ -1175,7 +1175,7 @@ EmitPostWriteBarrierS(MacroAssembler& masm, masm.bind(&exit); } -typedef JSObject* (*CloneRegExpObjectFn)(JSContext*, JSObject*); +typedef JSObject* (*CloneRegExpObjectFn)(JSContext*, Handle); static const VMFunction CloneRegExpObjectInfo = FunctionInfo(CloneRegExpObject, "CloneRegExpObject"); @@ -1815,10 +1815,10 @@ JitCompartment::generateRegExpMatcherStub(JSContext* cx) masm.branch32(Assembler::LessThan, stringIndexAddress, Imm32(0), &isUndefined); depStr[isLatin].generate(masm, cx->names(), isLatin, temp3, input, temp4, temp5, - stringIndexAddress, stringLimitAddress, failure); + stringIndexAddress, stringLimitAddress, stringsCanBeInNursery, failure); masm.storeValue(JSVAL_TYPE_STRING, temp3, stringAddress); - + // Storing into nursery-allocated results object's elements; no post barrier. masm.jump(&storeDone); masm.bind(&isUndefined); @@ -3836,16 +3836,17 @@ CodeGenerator::maybeEmitGlobalBarrierCheck(const LAllocation* maybeGlobal, OutOf masm.branch32(Assembler::NotEqual, addr, Imm32(0), ool->rejoin()); } -template +template void -CodeGenerator::visitPostWriteBarrierCommonO(LPostBarrierType* lir, OutOfLineCode* ool) +CodeGenerator::visitPostWriteBarrierCommon(LPostBarrierType* lir, OutOfLineCode* ool) { addOutOfLineCode(ool, lir->mir()); Register temp = ToTempRegisterOrInvalid(lir->temp()); if (lir->object()->isConstant()) { - // Constant nursery objects cannot appear here, see LIRGenerator::visitPostWriteElementBarrier. + // Constant nursery objects cannot appear here, see + // LIRGenerator::visitPostWriteElementBarrier. MOZ_ASSERT(!IsInsideNursery(&lir->object()->toConstant()->toObject())); } else { masm.branchPtrInNurseryChunk(Assembler::Equal, ToRegister(lir->object()), temp, @@ -3854,9 +3855,17 @@ CodeGenerator::visitPostWriteBarrierCommonO(LPostBarrierType* lir, OutOfLineCode maybeEmitGlobalBarrierCheck(lir->object(), ool); - Register valueObj = ToRegister(lir->value()); - masm.branchTestPtr(Assembler::Zero, valueObj, valueObj, ool->rejoin()); - masm.branchPtrInNurseryChunk(Assembler::Equal, ToRegister(lir->value()), temp, ool->entry()); + Register value = ToRegister(lir->value()); + if (nurseryType == MIRType::Object) { + if (lir->mir()->value()->type() == MIRType::ObjectOrNull) + masm.branchTestPtr(Assembler::Zero, value, value, ool->rejoin()); + else + MOZ_ASSERT(lir->mir()->value()->type() == MIRType::Object); + } else { + MOZ_ASSERT(nurseryType == MIRType::String); + MOZ_ASSERT(lir->mir()->value()->type() == MIRType::String); + } + masm.branchPtrInNurseryChunk(Assembler::Equal, value, temp, ool->entry()); masm.bind(ool->rejoin()); } @@ -7972,7 +7981,58 @@ CodeGenerator::visitFromCodePoint(LFromCodePoint* lir) masm.movePtr(ImmPtr(&GetJitContext()->runtime->staticStrings().unitStaticTable), output); masm.loadPtr(BaseIndex(output, codePoint, ScalePointer), output); - masm.bind(ool->rejoin()); + uint32_t flags = JSString::INIT_THIN_INLINE_FLAGS; + masm.newGCString(output, temp1, ool->entry(), gen->stringsCanBeInNursery()); + masm.store32(Imm32(flags), Address(output, JSString::offsetOfFlags())); + } + + Label isSupplementary; + masm.branch32(Assembler::AboveOrEqual, codePoint, Imm32(unicode::NonBMPMin), + &isSupplementary); + { + // Store length. + masm.store32(Imm32(1), Address(output, JSString::offsetOfLength())); + + // Load chars pointer in temp1. + masm.computeEffectiveAddress(Address(output, JSInlineString::offsetOfInlineStorage()), + temp1); + + masm.store16(codePoint, Address(temp1, 0)); + + // Null-terminate. + masm.store16(Imm32(0), Address(temp1, sizeof(char16_t))); + + masm.jump(done); + } + masm.bind(&isSupplementary); + { + // Store length. + masm.store32(Imm32(2), Address(output, JSString::offsetOfLength())); + + // Load chars pointer in temp1. + masm.computeEffectiveAddress(Address(output, JSInlineString::offsetOfInlineStorage()), + temp1); + + // Inlined unicode::LeadSurrogate(uint32_t). + masm.move32(codePoint, temp2); + masm.rshift32(Imm32(10), temp2); + masm.add32(Imm32(unicode::LeadSurrogateMin - (unicode::NonBMPMin >> 10)), temp2); + + masm.store16(temp2, Address(temp1, 0)); + + // Inlined unicode::TrailSurrogate(uint32_t). + masm.move32(codePoint, temp2); + masm.and32(Imm32(0x3FF), temp2); + masm.or32(Imm32(unicode::TrailSurrogateMin), temp2); + + masm.store16(temp2, Address(temp1, sizeof(char16_t))); + + // Null-terminate. + masm.store16(Imm32(0), Address(temp1, 2 * sizeof(char16_t))); + } + } + + masm.bind(done); } void diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp index eef25fe4c9..7b1a0145f6 100644 --- a/js/src/jit/IonBuilder.cpp +++ b/js/src/jit/IonBuilder.cpp @@ -9096,7 +9096,7 @@ jit::NeedsPostBarrier(MDefinition* value) return false; if (value->mightBeType(MIRType::Object)) return true; - if (value->mightBeType(MIRType::String) && runtime->canNurseryAllocateStrings()) + if (value->mightBeType(MIRType::String) && zone->canNurseryAllocateStrings()) return true; return false; } diff --git a/js/src/jit/MacroAssembler.cpp b/js/src/jit/MacroAssembler.cpp index 22f8ca8f8b..1be20c22b0 100644 --- a/js/src/jit/MacroAssembler.cpp +++ b/js/src/jit/MacroAssembler.cpp @@ -931,6 +931,7 @@ MacroAssembler::allocateString(Register result, Register temp, gc::AllocKind all freeListAllocate(result, temp, allocKind, fail); } +void MacroAssembler::newGCString(Register result, Register temp, Label* fail, bool attemptNursery) { allocateString(result, temp, js::gc::AllocKind::STRING,