Commit graph

7,824 commits

Author SHA1 Message Date
win7-7
b9a2a715cd Bug 903519 - allocate JSStrings and string data in the Nursery
903519 part 2: Reparent JSString from TenuredCell to Cell.

903519 Part 3: Make js::Allocate cast strings to requested type.

903519 Part 4: Force non-atom strings to have their low flag bit set in order to distinguish them from JSObjects in the nursery.

903519 Part 5: Strings in the nursery: allocation.

Mixed reset later.
2026-08-01 03:12:21 +01:00
win7-7
44bd6d9e6b Various fixes.
Various fixes. INIT_ROPE_FLAGS does not exist in this time of js engine, unsure why it was added. String.h fix  closure. Don't comment out new code in Barrier.h. Mir.h change back to MAryInstruction<4>, since MQuaternaryInstruction does not work and calls MAryInstruction<4> anyway. Note this likely need  parts of 1412912  hopefully solve failing static asserts.
2026-08-01 03:12:10 +01:00
win7-7
0319c4c77c 1464912 - Add exposeToActiveJS specialization for JSString.
1464912 - Add exposeToActiveJS specialization for JSString. Necessary for nursery.
2026-08-01 03:12:10 +01:00
win7-7
9959a69efd Remaining file updated.
Remaining file updated.
2026-08-01 03:12:10 +01:00
win7-7
1154dbddf6 903519 part 6 to 13 (partially)
903519 Part 6: Strings in the nursery: tracing and tenuring.

903519 Part 7: Strings in the nursery: barriers.

903519 Part 8: Discard nursery keys from EvalCache.

903519 Part 9:  Strings in the nursery: allow any thread to access zone of permanent atoms.

903519 Part 10: Strings in the nursery: MIR node.

903519 Part 11: Change Relocated marker to not confuse string vs object bit.

903519 Part 12: Default nursery strings to off, add ability to enable.

903519 Part 13: Strings in the nursery: JIT, partial due CodeGenerator.cpp differences startin from: // Follow any base pointer if the input is itself a dependent string.

This is due file changed: 1434230: Spectre mitigations for strings
2026-08-01 03:12:10 +01:00
win7-7
8bce0e2404 Bug 903519- GC: allocate JSStrings and string data in the Nursery.
903519 part 1: Separate out AllocKinds for nursery-allocatable strings.

Rest of part TBD: Need  1350760 Atomizing strings needs to be faster first.
2026-08-01 03:12:09 +01:00
win7-7
63b07c9a39 60 level before nursery strings.
1421319 - Split out GCManagedDeletePolicy into its own header.

1434622 - Use a separate lock to protect the shared script data table.
2026-08-01 03:12:06 +01:00
win7-7
13988e9a8b Compiles, links, does not crash. 59 GC.
Compiles, links, does not crash. 59 GC.
2026-08-01 03:11:54 +01:00
win7-7
1aefea85a2 Fixes.
Mostly taking care of headers splitting.
2026-08-01 03:11:50 +01:00
win7-7
9fd2d2683c 59 GC.
59 GC.
2026-08-01 03:11:34 +01:00
win7-7
c5d270f172 58 GC no crashing.
Compiles link no crashing.
2026-08-01 03:11:12 +01:00
win7-7
f9e762101d 58 a1 GC. Trying see when issue with atoms started.
58 a1 GC. Trying see when issue with atoms started.
2026-08-01 03:10:45 +01:00
win7-7
ba8872f5ce Now it compiles, links and works, apparently 56 GC is stable, 57 next.
Now it compiles, links and works, apparently 56 GC is stable, 57 next.
2026-08-01 03:10:30 +01:00
win7-7
24cf030a68 This does work.
This should work. Test gains.
2026-08-01 03:10:30 +01:00
Jon Coppeard
f5541a3cc2 Bug 1369748 - Refactor GCRuntime::beginMarkPhase r=sfink 2026-08-01 03:10:29 +01:00
win7-7
35e683a4fa 56 GC fixes.
56 GC fixes.
2026-08-01 03:10:29 +01:00
win7-7
17e93e902c 56 GC.
Trying narrow when atom crash started between 55 and 60 and if its easy to revert.
2026-08-01 03:10:25 +01:00
win7-7
a166624927 1345427 - Assertion failure: ins->type() == inputType, at js/src/jit/Lowering.cpp:1440
1345427: Effectively change output type of MNearbyInt when specializing to float32;
2026-08-01 03:09:37 +01:00
win7-7
458ea586de 1324566 - Inspector support for GlobalNameGetter, error fixed, march 28th 2024, there was backport of this but return false was accidentally leftover.
1324566 - Inspector support for GlobalNameGetter, error fixed, march 28th 2024, there was backport of this but return false was accidentally leftover.
2026-08-01 03:09:37 +01:00
win7-7
460d29b318 1344173 - Fix performance cliff involving OBJECT_FLAG_ITERATED and array natives also includes 1323782.
1344173 - Fix performance cliff involving OBJECT_FLAG_ITERATED and array natives.

1323782: Check iterated-flag before proceeding to fast path in Array.prototype.unshift.
2026-08-01 03:09:36 +01:00
win7-7
e6b7d6698b 1370210 - obj_propertyIsEnumerable calls non-inlined IsSymbolOrSymbolWrapper
1370210 - Optimize ValueToId and ValueToIdPure to check the common cases first
2026-08-01 03:09:36 +01:00
André Bargull
35ca1152a7 Bug 1379222 - Avoid [[Get]] for "prototype" property when calling builtin constructors. r=jandem 2026-08-01 03:09:36 +01:00
win7-7
c324e4df46 Accidental addition/regression from may 2025 merge. Took what was not needed and caused multi-threading regression for parsing.
Accidental addition/regression from may 2025 merge. Took what was not needed and caused multi-threading regression for parsing.
2026-08-01 03:09:36 +01:00
win7-7
50813a86e5 Security fixes toward 105 version.
Security fixes toward 105 version.
2026-08-01 03:09:35 +01:00
win7-7
6c6e0c524c Security fixes toward 71 version.
Security fixes toward 71 version.
2026-08-01 03:09:35 +01:00
win7-7
af10b8035e More security fixes toward 67 version.
More security fixes toward 67 version.
2026-08-01 03:09:35 +01:00
win7-7
aec88a162c Somewhat 60 level of security.
Somewhat 60 level of security.
2026-08-01 03:09:35 +01:00
win7-7
98e863440f Security fixes toward Firefox 58 level but might miss some. Check later.
Security fixes toward Firefox 58 level but might miss some. Check later.
2026-08-01 03:09:35 +01:00
win7-7
1f0c1ad851 1354527 - Crash [@ js::jit::RInstructionResults::operator[]]
1354527 - Recover the iterator object when closing during exception handling.
2026-08-01 03:09:34 +01:00
win7-7
64d22a5bb6 1352506 - Ion: Automatically call gen->setPerformsCall() if a LIR instruction performs a call
1352506: Remove dead code in the backtracking allocator;

1352506: Automatically setPerformsCall for LIR call instructions.

1352506: Don't conflate need for overrecursed check and static alignment in MIRGenerator;
2026-08-01 03:09:34 +01:00
win7-7
75adae3c46 1331900 - Delete Label's assignment operator.
Hiding it => linking error.
Deleting it => compilation error.
2026-08-01 03:09:34 +01:00
win7-7
934ecc01ff Bug 1405457 - Scalar replacement for call objects. r=nbp
Scalar replacement for call objects, should make arrow-declare six-speed test faster.
2026-08-01 03:09:34 +01:00
win7-7
9d0299434d 1355155 - Scalar replacement for arrow functions.
1355155 - Scalar replacement for arrow functions.
2026-08-01 03:09:34 +01:00
win7-7
7d7bd96403 1358599 - Use runtime guards for jitcode pre-barriers instead of patchable jumps, leftover/accidental reintroduction by CacheIR backporting.
1358599  - Use runtime guards for jitcode pre-barriers instead of patchable jumps, leftover/accidental reintroduction by CacheIR backporting.
2026-08-01 03:09:34 +01:00
win7-7
1f76c9c036 1325480 - Baldr: make WasmInstanceObject::ExportMap a strong edge
1325480 - Baldr: make WasmInstanceObject::ExportMap a strong edge
2026-08-01 03:09:33 +01:00
win7-7
0b212e1fe4 1339089 - Inline floor/ceil/trunc/nearest for floating-point values when we have adequate SSE support
1339089: Inline floor/ceil/trunc/nearest in Ion when we have sse4.

1339089: Inline wasm::floor/trunc/nearest/round in the baseline compiler too;
2026-08-01 03:09:33 +01:00
win7-7
225d2c73db 1316831 - Wasm baseline: Disable bounds checking on constant accesses below the minimum heap length
1316831 - wasm baseline, omit known-good bounds checks

Also includes 1353347 - wasm baseline, properly chop int32 constants to 32 bits.
2026-08-01 03:09:33 +01:00
win7-7
82b486fe9b 1337444 - wasm: runtime crash involving i64 globals
1337444: Fix regalloc of load/store i64 globals;
2026-08-01 03:09:33 +01:00
win7-7
76d0a10fee 1335068 - Wasm: Split the global allocation out of the CodeSegment
1335068 - Break wasm globals out of the code segment.
2026-08-01 03:09:33 +01:00
win7-7
0b36c23dc5 Bug 1312751 - Merge ARM load and store code for Wasm
1312751 - Refactor wasm{Load,Store}{,I64} to MacroAssembler-arm.

1312751 - Wasm baseline, use refactored ARM load/store methods.
2026-08-01 03:09:32 +01:00
win7-7
5d9bc9e53d 1330339 - Assertion failure: !done() && debugEnabled(), at js/src/wasm/WasmFrameIterator.cpp:223
1330339 - Ensure wasm debug is enabled when observesFrame is queried.
2026-08-01 03:09:32 +01:00
win7-7
842bee4099 1330491 - Assertion failure: maybeBytecode, at js/src/wasm/WasmCode.cpp:581 with Debugger
1330491 - Always provide wasm bytecode for debuggable instance.
2026-08-01 03:09:32 +01:00
win7-7
f8d18b97b1 1331064 - Assertion failure: throwing, at js/src/jscntxt.cpp:946 with wasm and Debugger
1331064 - Ignore wasm onExceptionUnwind events in JSTRAP_ERROR state.
2026-08-01 03:09:32 +01:00
win7-7
dc516e0658 1331592 - Assertion failure: data_.state_ == INTERP, at js/src/vm/Stack.cpp:495 with Debugger and wasm
1331592 - Skipping wasm frames during debugger eval.
2026-08-01 03:09:32 +01:00
win7-7
f1fdb383f6 1332493- Crash [@ js::wasm::Instance::object]
1332493 - Initialize wasm::DebugFrame before stack overflow check.
2026-08-01 03:09:32 +01:00
win7-7
5dde8c1c4a 1342497 - Baldr: store current frame, not previous frame, in wasm::FrameIterator
1342497 - Baldr: store current frame, not previous frame, in wasm::FrameIterator.
2026-08-01 03:09:32 +01:00
win7-7
b3e4157642 1330489 - Crash [@ mozilla::UniquePtr<JS::ubi::EdgeRange, JS::DeletePolicy<JS::ubi::EdgeRange> >::operator->] with wasm and Debugger
1330489 - Ignore imports for wasm debug frames and discard frames in activation on throw.
2026-08-01 03:09:31 +01:00
win7-7
6ec6324056 1331452 - jit-test/tests/debug/wasm-06.js failures with CGC builds
1331452 - Keep scope in a slot in WasmFunctionCallObjects.

1331452 - Followup: hazard fix.
2026-08-01 03:09:31 +01:00
win7-7
9754fb007b 1286948
1286948 - Adds debug mode for WASM baseline compiler.

1286948 - Adds scope and environment for wasm calls (Adds artificial JS scope and environment for wasm frames. That allows
debugger to properly handle call stack).

1286948 - Adds prolog and epilog debug traps and handlers (Using toggled call/traps to invoke handler to process enter and leave
frame events).

1286948 - onEnterFrame/onLeaveFrame wasm events and callstack (Handles onEnterFrame and onLeaveFrame trap handling. The FrameIter is used in
the DebuggerFrame instead of ScriptFrameIter. The debug wasm frame is created
and can be found on callstack during those event).

Does not compile without 1331452 - Keep scope in a slot in WasmFunctionCallObjects along with 1335773 - Inspects wasm function locals to build
2026-08-01 03:09:31 +01:00
win7-7
590d0e03f7 1326027: Remove RawF32 and RawF64;
1326027: Remove RawF32 and RawF64;

I did not do 1326027: include SSE2 flags in autospider due they were not even in js/src/moz.build so does SSE2 matter to UXP?
2026-08-01 03:09:31 +01:00