Commit graph

1,540 commits

Author SHA1 Message Date
win7-7
6079c8fdb4 903519 - Implement AutoSuppressNurseryCellAlloc to avoid nursery allocation just before offthread parse startup
903519 - Implement AutoSuppressNurseryCellAlloc to avoid nursery allocation just before offthread parse startup
2026-08-01 03:12:28 +01:00
win7-7
eb8b8e28d2 903519 - Split out string nursery pointers from object nursery
903519 - Split out string nursery pointers from object nursery, this was not done before.
2026-08-01 03:12:27 +01:00
win7-7
af8f174181 1444335 - Nursery allocation is not infallible, even right after collecting the nursery
1444335 - Nursery allocation is not infallible, even right after collecting the nursery. Hoping this solves crash.
2026-08-01 03:12:27 +01:00
win7-7
086bacbf22 903519 - Register nursery string buffers to be freed
903519 - Register nursery string buffers to be freed, this was missed somehow before.
2026-08-01 03:12:27 +01:00
win7-7
2c7a142dc6 Bug 903519 - Strings in the nursery: JIT
Bug 903519 - Strings in the nursery: JIT, majority of it was not done before due CodeGenerator.cpp
2026-08-01 03:12:27 +01:00
win7-7
166a98559f Fix more errors.
Fix more errors.
2026-08-01 03:12:27 +01:00
win7-7
53eb4e1f31 Sigh..
Sigh..
2026-08-01 03:12:27 +01:00
win7-7
7945c4577f Some more fixes.
Some more fixes.
2026-08-01 03:12:26 +01:00
win7-7
b9a2a715cd Bug 903519 - allocate JSStrings and string data in the Nursery
903519 part 2: Reparent JSString from TenuredCell to Cell.

903519 Part 3: Make js::Allocate cast strings to requested type.

903519 Part 4: Force non-atom strings to have their low flag bit set in order to distinguish them from JSObjects in the nursery.

903519 Part 5: Strings in the nursery: allocation.

Mixed reset later.
2026-08-01 03:12:21 +01:00
win7-7
44bd6d9e6b Various fixes.
Various fixes. INIT_ROPE_FLAGS does not exist in this time of js engine, unsure why it was added. String.h fix  closure. Don't comment out new code in Barrier.h. Mir.h change back to MAryInstruction<4>, since MQuaternaryInstruction does not work and calls MAryInstruction<4> anyway. Note this likely need  parts of 1412912  hopefully solve failing static asserts.
2026-08-01 03:12:10 +01:00
win7-7
0319c4c77c 1464912 - Add exposeToActiveJS specialization for JSString.
1464912 - Add exposeToActiveJS specialization for JSString. Necessary for nursery.
2026-08-01 03:12:10 +01:00
win7-7
9959a69efd Remaining file updated.
Remaining file updated.
2026-08-01 03:12:10 +01:00
win7-7
1154dbddf6 903519 part 6 to 13 (partially)
903519 Part 6: Strings in the nursery: tracing and tenuring.

903519 Part 7: Strings in the nursery: barriers.

903519 Part 8: Discard nursery keys from EvalCache.

903519 Part 9:  Strings in the nursery: allow any thread to access zone of permanent atoms.

903519 Part 10: Strings in the nursery: MIR node.

903519 Part 11: Change Relocated marker to not confuse string vs object bit.

903519 Part 12: Default nursery strings to off, add ability to enable.

903519 Part 13: Strings in the nursery: JIT, partial due CodeGenerator.cpp differences startin from: // Follow any base pointer if the input is itself a dependent string.

This is due file changed: 1434230: Spectre mitigations for strings
2026-08-01 03:12:10 +01:00
win7-7
8bce0e2404 Bug 903519- GC: allocate JSStrings and string data in the Nursery.
903519 part 1: Separate out AllocKinds for nursery-allocatable strings.

Rest of part TBD: Need  1350760 Atomizing strings needs to be faster first.
2026-08-01 03:12:09 +01:00
win7-7
63b07c9a39 60 level before nursery strings.
1421319 - Split out GCManagedDeletePolicy into its own header.

1434622 - Use a separate lock to protect the shared script data table.
2026-08-01 03:12:06 +01:00
win7-7
13988e9a8b Compiles, links, does not crash. 59 GC.
Compiles, links, does not crash. 59 GC.
2026-08-01 03:11:54 +01:00
win7-7
1aefea85a2 Fixes.
Mostly taking care of headers splitting.
2026-08-01 03:11:50 +01:00
win7-7
9fd2d2683c 59 GC.
59 GC.
2026-08-01 03:11:34 +01:00
win7-7
c5d270f172 58 GC no crashing.
Compiles link no crashing.
2026-08-01 03:11:12 +01:00
win7-7
f9e762101d 58 a1 GC. Trying see when issue with atoms started.
58 a1 GC. Trying see when issue with atoms started.
2026-08-01 03:10:45 +01:00
win7-7
ba8872f5ce Now it compiles, links and works, apparently 56 GC is stable, 57 next.
Now it compiles, links and works, apparently 56 GC is stable, 57 next.
2026-08-01 03:10:30 +01:00
win7-7
24cf030a68 This does work.
This should work. Test gains.
2026-08-01 03:10:30 +01:00
Jon Coppeard
f5541a3cc2 Bug 1369748 - Refactor GCRuntime::beginMarkPhase r=sfink 2026-08-01 03:10:29 +01:00
win7-7
35e683a4fa 56 GC fixes.
56 GC fixes.
2026-08-01 03:10:29 +01:00
win7-7
17e93e902c 56 GC.
Trying narrow when atom crash started between 55 and 60 and if its easy to revert.
2026-08-01 03:10:25 +01:00
win7-7
a166624927 1345427 - Assertion failure: ins->type() == inputType, at js/src/jit/Lowering.cpp:1440
1345427: Effectively change output type of MNearbyInt when specializing to float32;
2026-08-01 03:09:37 +01:00
win7-7
458ea586de 1324566 - Inspector support for GlobalNameGetter, error fixed, march 28th 2024, there was backport of this but return false was accidentally leftover.
1324566 - Inspector support for GlobalNameGetter, error fixed, march 28th 2024, there was backport of this but return false was accidentally leftover.
2026-08-01 03:09:37 +01:00
win7-7
460d29b318 1344173 - Fix performance cliff involving OBJECT_FLAG_ITERATED and array natives also includes 1323782.
1344173 - Fix performance cliff involving OBJECT_FLAG_ITERATED and array natives.

1323782: Check iterated-flag before proceeding to fast path in Array.prototype.unshift.
2026-08-01 03:09:36 +01:00
win7-7
e6b7d6698b 1370210 - obj_propertyIsEnumerable calls non-inlined IsSymbolOrSymbolWrapper
1370210 - Optimize ValueToId and ValueToIdPure to check the common cases first
2026-08-01 03:09:36 +01:00
André Bargull
35ca1152a7 Bug 1379222 - Avoid [[Get]] for "prototype" property when calling builtin constructors. r=jandem 2026-08-01 03:09:36 +01:00
win7-7
c324e4df46 Accidental addition/regression from may 2025 merge. Took what was not needed and caused multi-threading regression for parsing.
Accidental addition/regression from may 2025 merge. Took what was not needed and caused multi-threading regression for parsing.
2026-08-01 03:09:36 +01:00
win7-7
50813a86e5 Security fixes toward 105 version.
Security fixes toward 105 version.
2026-08-01 03:09:35 +01:00
win7-7
6c6e0c524c Security fixes toward 71 version.
Security fixes toward 71 version.
2026-08-01 03:09:35 +01:00
win7-7
af10b8035e More security fixes toward 67 version.
More security fixes toward 67 version.
2026-08-01 03:09:35 +01:00
win7-7
aec88a162c Somewhat 60 level of security.
Somewhat 60 level of security.
2026-08-01 03:09:35 +01:00
win7-7
98e863440f Security fixes toward Firefox 58 level but might miss some. Check later.
Security fixes toward Firefox 58 level but might miss some. Check later.
2026-08-01 03:09:35 +01:00
win7-7
1f0c1ad851 1354527 - Crash [@ js::jit::RInstructionResults::operator[]]
1354527 - Recover the iterator object when closing during exception handling.
2026-08-01 03:09:34 +01:00
win7-7
64d22a5bb6 1352506 - Ion: Automatically call gen->setPerformsCall() if a LIR instruction performs a call
1352506: Remove dead code in the backtracking allocator;

1352506: Automatically setPerformsCall for LIR call instructions.

1352506: Don't conflate need for overrecursed check and static alignment in MIRGenerator;
2026-08-01 03:09:34 +01:00
win7-7
75adae3c46 1331900 - Delete Label's assignment operator.
Hiding it => linking error.
Deleting it => compilation error.
2026-08-01 03:09:34 +01:00
win7-7
934ecc01ff Bug 1405457 - Scalar replacement for call objects. r=nbp
Scalar replacement for call objects, should make arrow-declare six-speed test faster.
2026-08-01 03:09:34 +01:00
win7-7
9d0299434d 1355155 - Scalar replacement for arrow functions.
1355155 - Scalar replacement for arrow functions.
2026-08-01 03:09:34 +01:00
win7-7
7d7bd96403 1358599 - Use runtime guards for jitcode pre-barriers instead of patchable jumps, leftover/accidental reintroduction by CacheIR backporting.
1358599  - Use runtime guards for jitcode pre-barriers instead of patchable jumps, leftover/accidental reintroduction by CacheIR backporting.
2026-08-01 03:09:34 +01:00
win7-7
1f76c9c036 1325480 - Baldr: make WasmInstanceObject::ExportMap a strong edge
1325480 - Baldr: make WasmInstanceObject::ExportMap a strong edge
2026-08-01 03:09:33 +01:00
win7-7
0b212e1fe4 1339089 - Inline floor/ceil/trunc/nearest for floating-point values when we have adequate SSE support
1339089: Inline floor/ceil/trunc/nearest in Ion when we have sse4.

1339089: Inline wasm::floor/trunc/nearest/round in the baseline compiler too;
2026-08-01 03:09:33 +01:00
win7-7
225d2c73db 1316831 - Wasm baseline: Disable bounds checking on constant accesses below the minimum heap length
1316831 - wasm baseline, omit known-good bounds checks

Also includes 1353347 - wasm baseline, properly chop int32 constants to 32 bits.
2026-08-01 03:09:33 +01:00
win7-7
82b486fe9b 1337444 - wasm: runtime crash involving i64 globals
1337444: Fix regalloc of load/store i64 globals;
2026-08-01 03:09:33 +01:00
win7-7
76d0a10fee 1335068 - Wasm: Split the global allocation out of the CodeSegment
1335068 - Break wasm globals out of the code segment.
2026-08-01 03:09:33 +01:00
win7-7
0b36c23dc5 Bug 1312751 - Merge ARM load and store code for Wasm
1312751 - Refactor wasm{Load,Store}{,I64} to MacroAssembler-arm.

1312751 - Wasm baseline, use refactored ARM load/store methods.
2026-08-01 03:09:32 +01:00
win7-7
5d9bc9e53d 1330339 - Assertion failure: !done() && debugEnabled(), at js/src/wasm/WasmFrameIterator.cpp:223
1330339 - Ensure wasm debug is enabled when observesFrame is queried.
2026-08-01 03:09:32 +01:00
win7-7
842bee4099 1330491 - Assertion failure: maybeBytecode, at js/src/wasm/WasmCode.cpp:581 with Debugger
1330491 - Always provide wasm bytecode for debuggable instance.
2026-08-01 03:09:32 +01:00