Commit graph

7,799 commits

Author SHA1 Message Date
win7-7
af10b8035e More security fixes toward 67 version.
More security fixes toward 67 version.
2026-08-01 03:09:35 +01:00
win7-7
aec88a162c Somewhat 60 level of security.
Somewhat 60 level of security.
2026-08-01 03:09:35 +01:00
win7-7
98e863440f Security fixes toward Firefox 58 level but might miss some. Check later.
Security fixes toward Firefox 58 level but might miss some. Check later.
2026-08-01 03:09:35 +01:00
win7-7
1f0c1ad851 1354527 - Crash [@ js::jit::RInstructionResults::operator[]]
1354527 - Recover the iterator object when closing during exception handling.
2026-08-01 03:09:34 +01:00
win7-7
64d22a5bb6 1352506 - Ion: Automatically call gen->setPerformsCall() if a LIR instruction performs a call
1352506: Remove dead code in the backtracking allocator;

1352506: Automatically setPerformsCall for LIR call instructions.

1352506: Don't conflate need for overrecursed check and static alignment in MIRGenerator;
2026-08-01 03:09:34 +01:00
win7-7
75adae3c46 1331900 - Delete Label's assignment operator.
Hiding it => linking error.
Deleting it => compilation error.
2026-08-01 03:09:34 +01:00
win7-7
934ecc01ff Bug 1405457 - Scalar replacement for call objects. r=nbp
Scalar replacement for call objects, should make arrow-declare six-speed test faster.
2026-08-01 03:09:34 +01:00
win7-7
9d0299434d 1355155 - Scalar replacement for arrow functions.
1355155 - Scalar replacement for arrow functions.
2026-08-01 03:09:34 +01:00
win7-7
7d7bd96403 1358599 - Use runtime guards for jitcode pre-barriers instead of patchable jumps, leftover/accidental reintroduction by CacheIR backporting.
1358599  - Use runtime guards for jitcode pre-barriers instead of patchable jumps, leftover/accidental reintroduction by CacheIR backporting.
2026-08-01 03:09:34 +01:00
win7-7
1f76c9c036 1325480 - Baldr: make WasmInstanceObject::ExportMap a strong edge
1325480 - Baldr: make WasmInstanceObject::ExportMap a strong edge
2026-08-01 03:09:33 +01:00
win7-7
0b212e1fe4 1339089 - Inline floor/ceil/trunc/nearest for floating-point values when we have adequate SSE support
1339089: Inline floor/ceil/trunc/nearest in Ion when we have sse4.

1339089: Inline wasm::floor/trunc/nearest/round in the baseline compiler too;
2026-08-01 03:09:33 +01:00
win7-7
225d2c73db 1316831 - Wasm baseline: Disable bounds checking on constant accesses below the minimum heap length
1316831 - wasm baseline, omit known-good bounds checks

Also includes 1353347 - wasm baseline, properly chop int32 constants to 32 bits.
2026-08-01 03:09:33 +01:00
win7-7
82b486fe9b 1337444 - wasm: runtime crash involving i64 globals
1337444: Fix regalloc of load/store i64 globals;
2026-08-01 03:09:33 +01:00
win7-7
76d0a10fee 1335068 - Wasm: Split the global allocation out of the CodeSegment
1335068 - Break wasm globals out of the code segment.
2026-08-01 03:09:33 +01:00
win7-7
0b36c23dc5 Bug 1312751 - Merge ARM load and store code for Wasm
1312751 - Refactor wasm{Load,Store}{,I64} to MacroAssembler-arm.

1312751 - Wasm baseline, use refactored ARM load/store methods.
2026-08-01 03:09:32 +01:00
win7-7
5d9bc9e53d 1330339 - Assertion failure: !done() && debugEnabled(), at js/src/wasm/WasmFrameIterator.cpp:223
1330339 - Ensure wasm debug is enabled when observesFrame is queried.
2026-08-01 03:09:32 +01:00
win7-7
842bee4099 1330491 - Assertion failure: maybeBytecode, at js/src/wasm/WasmCode.cpp:581 with Debugger
1330491 - Always provide wasm bytecode for debuggable instance.
2026-08-01 03:09:32 +01:00
win7-7
f8d18b97b1 1331064 - Assertion failure: throwing, at js/src/jscntxt.cpp:946 with wasm and Debugger
1331064 - Ignore wasm onExceptionUnwind events in JSTRAP_ERROR state.
2026-08-01 03:09:32 +01:00
win7-7
dc516e0658 1331592 - Assertion failure: data_.state_ == INTERP, at js/src/vm/Stack.cpp:495 with Debugger and wasm
1331592 - Skipping wasm frames during debugger eval.
2026-08-01 03:09:32 +01:00
win7-7
f1fdb383f6 1332493- Crash [@ js::wasm::Instance::object]
1332493 - Initialize wasm::DebugFrame before stack overflow check.
2026-08-01 03:09:32 +01:00
win7-7
5dde8c1c4a 1342497 - Baldr: store current frame, not previous frame, in wasm::FrameIterator
1342497 - Baldr: store current frame, not previous frame, in wasm::FrameIterator.
2026-08-01 03:09:32 +01:00
win7-7
b3e4157642 1330489 - Crash [@ mozilla::UniquePtr<JS::ubi::EdgeRange, JS::DeletePolicy<JS::ubi::EdgeRange> >::operator->] with wasm and Debugger
1330489 - Ignore imports for wasm debug frames and discard frames in activation on throw.
2026-08-01 03:09:31 +01:00
win7-7
6ec6324056 1331452 - jit-test/tests/debug/wasm-06.js failures with CGC builds
1331452 - Keep scope in a slot in WasmFunctionCallObjects.

1331452 - Followup: hazard fix.
2026-08-01 03:09:31 +01:00
win7-7
9754fb007b 1286948
1286948 - Adds debug mode for WASM baseline compiler.

1286948 - Adds scope and environment for wasm calls (Adds artificial JS scope and environment for wasm frames. That allows
debugger to properly handle call stack).

1286948 - Adds prolog and epilog debug traps and handlers (Using toggled call/traps to invoke handler to process enter and leave
frame events).

1286948 - onEnterFrame/onLeaveFrame wasm events and callstack (Handles onEnterFrame and onLeaveFrame trap handling. The FrameIter is used in
the DebuggerFrame instead of ScriptFrameIter. The debug wasm frame is created
and can be found on callstack during those event).

Does not compile without 1331452 - Keep scope in a slot in WasmFunctionCallObjects along with 1335773 - Inspects wasm function locals to build
2026-08-01 03:09:31 +01:00
win7-7
590d0e03f7 1326027: Remove RawF32 and RawF64;
1326027: Remove RawF32 and RawF64;

I did not do 1326027: include SSE2 flags in autospider due they were not even in js/src/moz.build so does SSE2 matter to UXP?
2026-08-01 03:09:31 +01:00
win7-7
4c325bbdd2 1342045: Allow wasm::Memory of size 2**32
1342045: Allow wasm::Memory of size 2**32
2026-08-01 03:09:30 +01:00
win7-7
e75935a793 Bug 1332772 - Baldr: tweak memory/table limits
1332772 - Baldr: tweak memory/table limits
2026-08-01 03:09:30 +01:00
win7-7
939aa7fb5b Bug 1324008 Baldr: tweak internal limits to match other browsers
1324008 - Baldr: tweak internal limits to match other browsers.
2026-08-01 03:09:30 +01:00
win7-7
7008066b51 1329096 + 1316814
1316814 - Split wasm iterator's readEnd and popEnd.

1316814 - wasm baseline, use the iterator's control stack.

1329096 - Wasm baseline, remove the label pool and use NonAssertingLabel instead.

 1316814 is for preparation later for 1277562 (
Wasm: tiered compiler).
2026-08-01 03:09:30 +01:00
win7-7
9f9349f296 1326160 Wasm baseline: Division by nonzero constants can omit divide-by-zero check
1326160 - Omit divide by zero and overflow checks for some constants
2026-08-01 03:09:30 +01:00
win7-7
d100b1fbca 1316803 Wasm baseline: fold constant rhs into integer operations
1316803 part 1 - fold constant rhs for add/sub/shift/rotate/bitwise-ops.

1316803 part 2 - optimize division for constant rhs.
2026-08-01 03:09:30 +01:00
win7-7
965f656c72 1318252 - Baldr: Serialize Import's DefinitionKind
Otherwise, all imports are treated as function imports after deserialization. Fixes crash with 1321122.
2026-08-01 03:09:29 +01:00
win7-7
f1bb9e3b2d 1329018 Wasm: Move validation to helper threads, also 1317678
1329018 - Part 1: Wasm: Add plumbing for compile threads to report validation errors.

1329018 - Part 2: Wasm: Move function validation to helper threads.

Also: 1317678 - don't unconditionally unroll stack probe loop
2026-08-01 03:09:29 +01:00
win7-7
1f6c6d4469 1321122 - Baldr: add Module.customSections.
1321122 - Baldr: add Module.customSections.

As added here:
  https://github.com/WebAssembly/design/pull/877
2026-08-01 03:09:29 +01:00
win7-7
d23ddf632e Don't undo progress on batch compilation accidentally.
Don't undo progress on batch compilation accidentally.
2026-08-01 03:09:29 +01:00
win7-7
ba8732b25b 1316634 - Implement efficient WebAssembly.validate
1316634: Use ModuleEnvironment in the FunctionDecoder.

1316634: Move function validation to WasmBinaryFormat.h/cpp && rename it WasmValidate.

1316634: Implement efficient WebAssembly.validate

1316634: Use CheckedInt before checking against maximum limits
2026-08-01 03:09:29 +01:00
win7-7
69496939ad 1455703: Check for OOM in AstDecodeModuleTail
1455703: Check for OOM in AstDecodeModuleTail.
2026-08-01 03:09:29 +01:00
win7-7
562b53c8b4 1317319 wasm: Factor out section decoding, Part 2
1317319: Factor out Table section decoding.

1317319: Factor out Global section decoding.

1317319: Factor out Export section decoding.

1317319: Factor out Start section decoding.

1317319: Factor out Elem section decoding.

1317319: Move sections decoding around to follow their order in the binary.

1317319: Rename ModuleGeneratorData to ModuleEnvironment.

1317319: Embed most section decoding under DecodeModuleEnvironment.

1317319: Account imported globals when checking against the maximum number of globals.

1317319: Fix BinaryToAST function validation.

Fix error losing PrevEncodingVersion when refactoring for 1317319  part 2.

1317319: Tweak AstDecodeFunctionBody;
2026-08-01 03:09:28 +01:00
win7-7
7a7950b212 1298139 - Make LoopUnroller code handle OOM correctly
1298139 - Make LoopUnroller code handle OOM correctly
2026-08-01 03:09:28 +01:00
win7-7
d0736eaa44 1331414: Adding javascript.options.jit.full_debug_checks in about:config for people that want to use debug builds for surfing with less slowdown
1331414: Adding javascript.options.jit.full_debug_checks in about:config for people that want to use debug builds for surfing with less slowdown
2026-08-01 03:09:28 +01:00
win7-7
2497cc338e Stability fixes backporting.
1438645 - Prevent XDR from reading past its buffer.,

1325345 - Add compartment asserts to JS_FireOnNewGlobalObject and other APIs.

1339411 - Rewrite and optimize object allocation paths, NatibeObject.h, NativeObject-inl.h and jsiter.cpp were not updated use  JS::Result for stability, do that now.
2026-08-01 03:09:28 +01:00
win7-7
5741caf9b2 1370922 - [Ion] Handle allocation failure when generating Math.min.
1370922 - [Ion] Handle allocation failure when generating Math.min.
2026-08-01 03:09:28 +01:00
win7-7
8ce7ad6871 This change to add 1316078 part 4 - Add a script decoder as a valid off-main-thread parse-task was missed.
This change to add 1316078 part 4 - Add a script decoder as a valid off-main-thread parse-task was missed.
2026-08-01 03:09:28 +01:00
win7-7
148f327c8a Typo fix.
Typo fix.
2026-08-01 03:09:27 +01:00
win7-7
d116bfdfef Mix 55 js engine backporting mostly bugfixes.
1369337 - Forcibly create length and @@iterator properties for arguments when redefining.

1369680 - Use HasOwnProperty when resolving lazy properties to avoid triggering proxy traps in the proto-chain.

1319443 - Fix GlobalScopes XDR to encode global function bindings.

1335571 - Use template craziness to allow covering more cases with compartment asserts.
2026-08-01 03:09:27 +01:00
win7-7
f4b5f122a6 Performance improvements jit
1322724: IonMonkey - Add the hit count information on the extra false branch blocks

1322932: IonMonkey - Only iterate the backedge of the inner-loop when it has already be visited

1329901 - Remove expensive isObservableOperand() loop guards.

1330667: IonMonkey - Create a new constant for every optimized arguments use.

1342016 - Fast-path for isObservableSlot().

1388045 - Branch Pruning: Check the compile info associated with the resume point.
2026-08-01 03:09:27 +01:00
win7-7
b77788a7bd 1357680 and followup security fixes.
1357680 part 1 - Track Ion-inlined scripts explicitly so we can inline functions with unknown properties.

1357680 part 2 - Remove unnecessary setNewGroupUnknown call in SetClassAndProto.

1357680 part 3 - Don't mark the new group as having unknown properties when changing an object's proto.

1365518 - Fix polymorphic inlining to work correctly for functions that had their group/proto changed.

1368570 - Fix js::FinishCompilation to handle OOM correctly.

1395919 - Don't copy the unknown-properties flag in AddPropertyTypesAfterProtoChange.

1544386 part 1 - Call ElementAccessHasExtraIndexedProperty instead of ArrayPrototypeHasIndexedProperty when inlining array natives.

1538006 - Propagate unknownProperties when changing prototype.

1538006 - Don't emit unbarriered writes to an object if its group might change.
2026-08-01 03:09:27 +01:00
win7-7
52c12f5041 Two lines in this file were missed when doing 1342856 - Optimize volatile register spilling for C++ calls from IC stubs
Two lines in this file were missed when doing 1342856 - Optimize volatile register spilling for C++ calls from IC stubs, fixed now.
2026-08-01 03:09:27 +01:00
win7-7
5eb6f53b0d Performance improvements jit
1322724: IonMonkey - Add the hit count information on the extra false branch blocks

1322932: IonMonkey - Only iterate the backedge of the inner-loop when it has already be visited

1329901 - Remove expensive isObservableOperand() loop guards.

1330667: IonMonkey - Create a new constant for every optimized arguments use.

1342016 - Fast-path for isObservableSlot().

1388045 - Branch Pruning: Check the compile info associated with the resume point.
2026-08-01 03:09:21 +01:00
win7-7
8a82d779d7 Assert fixes and sec-fix.
Bug 1335146: IonMonkey - Don't do flow-aa on blocks without entry predecessor.

1329665 - Use fallible allocator in FlowAliasAnalysis::saveStoreDependency.

1329651: IonMonkey - Ensure ballast in EliminateDeadResumePointOperands.

Sec-fix: 1355050 - Root the RegExpShared in RegExpMacroAssembler

1375436: Assertion failure: throwing, at js/src/jscntxt.cpp:1466 with Debugger and async

Fix typo while at it in CodeGenerator.cpp
2026-08-01 03:07:33 +01:00