tor-browser

commit 81cf1665b1f59418eb042b669d8974990a69f4e3
parent dbce81a8d69d3bd649493cd459ca8342b53a28d7
Author: Iain Ireland <iireland@mozilla.com>
Date:   Thu, 27 Nov 2025 21:39:56 +0000

Bug 2000328: Implement WeakMapObject::hasObject inline r=jandem

Differential Revision: https://phabricator.services.mozilla.com/D273675

Diffstat:
M
js/src/jit/CodeGenerator.cpp
 | 
73
+++++++++++++++++++++++++++++++++++++++++++++++++++++++------------------
M
js/src/jit/CodeGenerator.h
 | 
6
++++++
M
js/src/jit/Lowering.cpp
 | 
7
+++++++
M
js/src/jit/MIROps.yaml
 | 
6
+++++-

4 files changed, 73 insertions(+), 19 deletions(-)
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
@@ -22673,22 +22673,11 @@ void CodeGenerator::visitMapObjectSize(LMapObjectSize* ins) {
   masm.loadMapObjectSize(mapObj, output);
 }
 
-void CodeGenerator::visitWeakMapGetObject(LWeakMapGetObject* ins) {
-#ifndef JS_CODEGEN_X86
-  Register weakMap = ToRegister(ins->weakMap());
-  Register obj = ToRegister(ins->object());
-  Register hashTable = ToRegister(ins->temp0());
-  Register hashCode = ToRegister(ins->temp1());
-  Register scratch = ToRegister(ins->temp2());
-  Register scratch2 = ToRegister(ins->temp3());
-  Register scratch3 = ToRegister(ins->temp4());
-  Register scratch4 = ToRegister(ins->temp5());
-  Register scratch5 = ToRegister(ins->temp6());
-  ValueOperand output = ToOutValue(ins);
-
-  Label found, missing;
-
-  // Load hash map if it exists. If not, return `undefined`.
+void CodeGenerator::emitWeakMapLookupObject(
+    Register weakMap, Register obj, Register hashTable, Register hashCode,
+    Register scratch, Register scratch2, Register scratch3, Register scratch4,
+    Register scratch5, Label* found, Label* missing) {
+  // Load hash map if it exists. If not, jump to missing.
   Address mapAddr(weakMap,
                   NativeObject::getFixedSlotOffset(WeakMapObject::DataSlot));
   masm.branchTestUndefined(Assembler::Equal, mapAddr, missing);
@@ -22710,14 +22699,35 @@ void CodeGenerator::visitWeakMapGetObject(LWeakMapGetObject* ins) {
     Label noMatch;
     masm.fallibleUnboxObject(Address(entry, Entry::offsetOfKey()), scratch2,
                              &noMatch);
-    masm.branchPtr(Assembler::Equal, obj, scratch2, &found);
+    masm.branchPtr(Assembler::Equal, obj, scratch2, found);
     masm.bind(&noMatch);
   };
   masm.lookupMFBT<WeakMapObject::Map>(hashTable, hashCode, scratch, scratch2,
-                                      scratch3, scratch4, scratch5, &missing,
+                                      scratch3, scratch4, scratch5, missing,
                                       matchEntry);
+}
+
+void CodeGenerator::visitWeakMapGetObject(LWeakMapGetObject* ins) {
+#ifndef JS_CODEGEN_X86
+  Register weakMap = ToRegister(ins->weakMap());
+  Register obj = ToRegister(ins->object());
+  Register hashTable = ToRegister(ins->temp0());
+  Register hashCode = ToRegister(ins->temp1());
+  Register scratch = ToRegister(ins->temp2());
+  Register scratch2 = ToRegister(ins->temp3());
+  Register scratch3 = ToRegister(ins->temp4());
+  Register scratch4 = ToRegister(ins->temp5());
+  Register scratch5 = ToRegister(ins->temp6());
+  ValueOperand output = ToOutValue(ins);
+
+  Label found, missing;
+
+  emitWeakMapLookupObject(weakMap, obj, hashTable, hashCode, scratch, scratch2,
+                          scratch3, scratch4, scratch5, &found, &missing);
+
   masm.bind(&found);
 
+  using Entry = WeakMapObject::Map::Entry;
   masm.loadValue(Address(scratch, Entry::offsetOfValue()), output);
 
   auto* ool = new (alloc()) LambdaOutOfLineCode([=](OutOfLineCode& ool) {
@@ -22775,6 +22785,32 @@ void CodeGenerator::visitWeakMapGetObject(LWeakMapGetObject* ins) {
 }
 
 void CodeGenerator::visitWeakMapHasObject(LWeakMapHasObject* ins) {
+#ifndef JS_CODEGEN_X86
+  Register weakMap = ToRegister(ins->weakMap());
+  Register obj = ToRegister(ins->object());
+  Register hashTable = ToRegister(ins->temp0());
+  Register hashCode = ToRegister(ins->temp1());
+  Register scratch = ToRegister(ins->temp2());
+  Register scratch2 = ToRegister(ins->temp3());
+  Register scratch3 = ToRegister(ins->temp4());
+  Register scratch4 = ToRegister(ins->temp5());
+  Register scratch5 = ToRegister(ins->temp6());
+  Register output = ToRegister(ins->output());
+
+  Label found, missing, done;
+
+  emitWeakMapLookupObject(weakMap, obj, hashTable, hashCode, scratch, scratch2,
+                          scratch3, scratch4, scratch5, &found, &missing);
+
+  masm.bind(&found);
+  masm.move32(Imm32(1), output);
+  masm.jump(&done);
+
+  masm.bind(&missing);
+  masm.move32(Imm32(0), output);
+  masm.bind(&done);
+#else
+  // x86 doesn't have enough registers, so we call into the VM.
   Register weakMap = ToRegister(ins->weakMap());
   Register obj = ToRegister(ins->object());
   Register output = ToRegister(ins->output());
@@ -22785,6 +22821,7 @@ void CodeGenerator::visitWeakMapHasObject(LWeakMapHasObject* ins) {
   masm.passABIArg(obj);
   masm.callWithABI<Fn, js::WeakMapObject::hasObject>();
   masm.storeCallBoolResult(output);
+#endif
 }
 
 void CodeGenerator::visitWeakSetHasObject(LWeakSetHasObject* ins) {
diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
@@ -239,6 +239,12 @@ class CodeGenerator final : public CodeGeneratorSpecific {
   void emitMaybeAtomizeSlot(LInstruction* ins, Register stringReg,
                             Address slotAddr, TypedOrValueRegister dest);
 
+  void emitWeakMapLookupObject(Register weakMap, Register obj,
+                               Register hashTable, Register hashCode,
+                               Register scratch, Register scratch2,
+                               Register scratch3, Register scratch4,
+                               Register scratch5, Label* found, Label* missing);
+
   using RegisterOrInt32 = mozilla::Variant<Register, int32_t>;
 
   static RegisterOrInt32 ToRegisterOrInt32(const LAllocation* allocation);
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
@@ -8185,9 +8185,16 @@ void LIRGenerator::visitWeakMapGetObject(MWeakMapGetObject* ins) {
 }
 
 void LIRGenerator::visitWeakMapHasObject(MWeakMapHasObject* ins) {
+#ifdef JS_CODEGEN_X86
   auto* lir = new (alloc()) LWeakMapHasObject(
       useRegisterAtStart(ins->weakMap()), useRegisterAtStart(ins->object()));
   defineReturn(lir, ins);
+#else
+  auto* lir = new (alloc()) LWeakMapHasObject(
+      useRegisterAtStart(ins->weakMap()), useRegisterAtStart(ins->object()),
+      temp(), temp(), temp(), temp(), temp(), temp(), temp());
+  define(lir, ins);
+#endif
 }
 
 void LIRGenerator::visitWeakSetHasObject(MWeakSetHasObject* ins) {
diff --git a/js/src/jit/MIROps.yaml b/js/src/jit/MIROps.yaml
@@ -3935,8 +3935,12 @@
   result_type: Boolean
   alias_set: custom
   movable: false
-  possibly_calls: true
   generate_lir: true
+#ifdef JS_CODEGEN_X86
+  possibly_calls: true
+#else
+  lir_temps: 7
+#endif
 
 - name: WeakSetHasObject
   operands: