tor-browser

commit ac5b254eb6e34c82c248ba525106c5c9d671f147
parent 1f17646b88e61773e6977d42facf191e4a7940be
Author: André Bargull <andre.bargull@gmail.com>
Date:   Tue, 21 Oct 2025 07:05:41 +0000

Bug 1991402 - Part 6: Convert Set inlinable getters. r=jandem

Add `JS_INLINABLE_PSG` to mark inlinable native getter functions, mirroring the
`JS_INLINABLE_FN` macro.

Inlining `Set.prototype.size` can simply reuse `InlinableNative::SetSize`. The
next part will optimise `InlinableNativeIRGenerator::tryAttachSetSize`, so we
don't emit `GuardShape` and `GuardToClass` instructions when accessing the
`size` property.

Differential Revision: https://phabricator.services.mozilla.com/D266598

Diffstat:
M
js/public/PropertySpec.h
 | 
3
+++
M
js/src/builtin/MapObject.cpp
 | 
2
+-
M
js/src/builtin/MapObject.h
 | 
4
----
M
js/src/jit/CacheIR.cpp
 | 
48
------------------------------------------------
M
js/src/jit/CacheIRGenerator.h
 | 
2
--

5 files changed, 4 insertions(+), 55 deletions(-)
diff --git a/js/public/PropertySpec.h b/js/public/PropertySpec.h
@@ -366,6 +366,9 @@ constexpr uint8_t CheckAccessorAttrs() {
 #define JS_PSG(name, getter, attributes)                                  \
   JSPropertySpec::nativeAccessors(name, CheckAccessorAttrs<attributes>(), \
                                   getter, nullptr)
+#define JS_INLINABLE_PSG(name, getter, attributes, native)                \
+  JSPropertySpec::nativeAccessors(name, CheckAccessorAttrs<attributes>(), \
+                                  getter, &js::jit::JitInfo_##native)
 #define JS_PSGS(name, getter, setter, attributes)                         \
   JSPropertySpec::nativeAccessors(name, CheckAccessorAttrs<attributes>(), \
                                   getter, nullptr, setter, nullptr)
diff --git a/js/src/builtin/MapObject.cpp b/js/src/builtin/MapObject.cpp
@@ -1242,7 +1242,7 @@ const JSClass SetObject::protoClass_ = {
 };
 
 const JSPropertySpec SetObject::properties[] = {
-    JS_PSG("size", size, 0),
+    JS_INLINABLE_PSG("size", size, 0, SetSize),
     JS_STRING_SYM_PS(toStringTag, "Set", JSPROP_READONLY),
     JS_PS_END,
 };
diff --git a/js/src/builtin/MapObject.h b/js/src/builtin/MapObject.h
@@ -311,10 +311,6 @@ class SetObject : public OrderedHashSetObject {
 
   size_t sizeOfData(mozilla::MallocSizeOf mallocSizeOf);
 
-  static bool isOriginalSizeGetter(Native native) {
-    return native == static_cast<Native>(SetObject::size);
-  }
-
  private:
   static const ClassSpec classSpec_;
   static const JSClassOps classOps_;
diff --git a/js/src/jit/CacheIR.cpp b/js/src/jit/CacheIR.cpp
@@ -470,7 +470,6 @@ AttachDecision GetPropIRGenerator::tryAttachStub() {
       TRY_ATTACH(tryAttachArrayBufferMaybeShared(obj, objId, id));
       TRY_ATTACH(tryAttachRegExp(obj, objId, id));
       TRY_ATTACH(tryAttachMap(obj, objId, id));
-      TRY_ATTACH(tryAttachSet(obj, objId, id));
       TRY_ATTACH(tryAttachNative(obj, objId, id, receiverId));
       TRY_ATTACH(tryAttachModuleNamespace(obj, objId, id));
       TRY_ATTACH(tryAttachWindowProxy(obj, objId, id));
@@ -2826,53 +2825,6 @@ AttachDecision GetPropIRGenerator::tryAttachMap(HandleObject obj,
   return AttachDecision::Attach;
 }
 
-AttachDecision GetPropIRGenerator::tryAttachSet(HandleObject obj,
-                                                ObjOperandId objId,
-                                                HandleId id) {
-  if (!obj->is<SetObject>()) {
-    return AttachDecision::NoAction;
-  }
-  auto* setObj = &obj->as<SetObject>();
-
-  if (mode_ != ICState::Mode::Specialized) {
-    return AttachDecision::NoAction;
-  }
-
-  // Receiver should be the object.
-  if (isSuper()) {
-    return AttachDecision::NoAction;
-  }
-
-  if (!id.isAtom(cx_->names().size)) {
-    return AttachDecision::NoAction;
-  }
-
-  NativeObject* holder = nullptr;
-  Maybe<PropertyInfo> prop;
-  NativeGetPropKind kind =
-      CanAttachNativeGetProp(cx_, obj, id, &holder, &prop, pc_);
-  if (kind != NativeGetPropKind::NativeGetter) {
-    return AttachDecision::NoAction;
-  }
-
-  auto& fun = holder->getGetter(*prop)->as<JSFunction>();
-  if (!SetObject::isOriginalSizeGetter(fun.native())) {
-    return AttachDecision::NoAction;
-  }
-
-  maybeEmitIdGuard(id);
-
-  // Emit all the normal guards for calling this native, but specialize
-  // callNativeGetterResult.
-  emitCallGetterResultGuards(setObj, holder, id, *prop, objId);
-
-  writer.setSizeResult(objId);
-  writer.returnFromIC();
-
-  trackAttached("GetProp.SetSize");
-  return AttachDecision::Attach;
-}
-
 AttachDecision GetPropIRGenerator::tryAttachFunction(HandleObject obj,
                                                      ObjOperandId objId,
                                                      HandleId id) {
diff --git a/js/src/jit/CacheIRGenerator.h b/js/src/jit/CacheIRGenerator.h
@@ -187,8 +187,6 @@ class MOZ_RAII GetPropIRGenerator : public IRGenerator {
                                  HandleId id);
   AttachDecision tryAttachMap(HandleObject obj, ObjOperandId objId,
                               HandleId id);
-  AttachDecision tryAttachSet(HandleObject obj, ObjOperandId objId,
-                              HandleId id);
   AttachDecision tryAttachModuleNamespace(HandleObject obj, ObjOperandId objId,
                                           HandleId id);
   AttachDecision tryAttachWindowProxy(HandleObject obj, ObjOperandId objId,