1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
|
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
* vim: set ts=8 sts=2 et sw=2 tw=80:
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
#include "vm/Watchtower.h"
#include "js/CallAndConstruct.h"
#include "vm/Compartment.h"
#include "vm/JSContext.h"
#include "vm/JSObject.h"
#include "vm/NativeObject.h"
#include "vm/PlainObject.h"
#include "vm/Realm.h"
#include "vm/Compartment-inl.h"
#include "vm/JSObject-inl.h"
#include "vm/Realm-inl.h"
#include "vm/Shape-inl.h"
using namespace js;
static bool AddToWatchtowerLog(JSContext* cx, const char* kind,
HandleObject obj, HandleValue extra) {
// Add an object storing {kind, object, extra} to the log for testing
// purposes.
MOZ_ASSERT(obj->useWatchtowerTestingLog());
RootedString kindString(cx, NewStringCopyZ<CanGC>(cx, kind));
if (!kindString) {
return false;
}
Rooted<PlainObject*> logObj(cx, NewPlainObjectWithProto(cx, nullptr));
if (!logObj) {
return false;
}
if (!JS_DefineProperty(cx, logObj, "kind", kindString, JSPROP_ENUMERATE)) {
return false;
}
if (!JS_DefineProperty(cx, logObj, "object", obj, JSPROP_ENUMERATE)) {
return false;
}
if (!JS_DefineProperty(cx, logObj, "extra", extra, JSPROP_ENUMERATE)) {
return false;
}
if (!cx->runtime()->watchtowerTestingLog->append(logObj)) {
ReportOutOfMemory(cx);
return false;
}
return true;
}
static bool ReshapeForShadowedProp(JSContext* cx, Handle<NativeObject*> obj,
HandleId id) {
// |obj| has been used as the prototype of another object. Check if we're
// shadowing a property on its proto chain. In this case we need to reshape
// that object for shape teleporting to work correctly.
//
// See also the 'Shape Teleporting Optimization' comment in jit/CacheIR.cpp.
MOZ_ASSERT(obj->isUsedAsPrototype());
// Lookups on integer ids cannot be cached through prototypes.
if (id.isInt()) {
return true;
}
RootedObject proto(cx, obj->staticPrototype());
while (proto) {
// Lookups will not be cached through non-native protos.
if (!proto->is<NativeObject>()) {
break;
}
if (proto->as<NativeObject>().contains(cx, id)) {
return JSObject::setInvalidatedTeleporting(cx, proto);
}
proto = proto->staticPrototype();
}
return true;
}
static void InvalidateMegamorphicCache(JSContext* cx,
Handle<NativeObject*> obj) {
// The megamorphic cache only checks the receiver object's shape. We need to
// invalidate the cache when a prototype object changes its set of properties,
// to account for cached properties that are deleted, turned into an accessor
// property, or shadowed by another object on the proto chain.
MOZ_ASSERT(obj->isUsedAsPrototype());
cx->caches().megamorphicCache.bumpGeneration();
cx->caches().megamorphicSetPropCache->bumpGeneration();
}
// static
bool Watchtower::watchPropertyAddSlow(JSContext* cx, Handle<NativeObject*> obj,
HandleId id) {
MOZ_ASSERT(watchesPropertyAdd(obj));
if (obj->isUsedAsPrototype()) {
if (!ReshapeForShadowedProp(cx, obj, id)) {
return false;
}
if (!id.isInt()) {
InvalidateMegamorphicCache(cx, obj);
}
}
if (MOZ_UNLIKELY(obj->useWatchtowerTestingLog())) {
RootedValue val(cx, IdToValue(id));
if (!AddToWatchtowerLog(cx, "add-prop", obj, val)) {
return false;
}
}
return true;
}
static bool ReshapeForProtoMutation(JSContext* cx, HandleObject obj) {
// To avoid the JIT guarding on each prototype in the proto chain to detect
// prototype mutation, we can instead reshape the rest of the proto chain such
// that a guard on any of them is sufficient. To avoid excessive reshaping and
// invalidation, we apply heuristics to decide when to apply this and when
// to require a guard.
//
// There are two cases:
//
// (1) The object is not marked IsUsedAsPrototype. This is the common case.
// Because shape implies proto, we rely on the caller changing the
// object's shape. The JIT guards on this object's shape or prototype so
// there's nothing we have to do here for objects on the proto chain.
//
// (2) The object is marked IsUsedAsPrototype. This implies the object may be
// participating in shape teleporting. To invalidate JIT ICs depending on
// the proto chain being unchanged, set the InvalidatedTeleporting shape
// flag for this object and objects on its proto chain.
//
// This flag disables future shape teleporting attempts, so next time this
// happens the loop below will be a no-op.
//
// NOTE: We only handle NativeObjects and don't propagate reshapes through
// any non-native objects on the chain.
//
// See Also:
// - GeneratePrototypeGuards
// - GeneratePrototypeHoleGuards
MOZ_ASSERT(obj->isUsedAsPrototype());
RootedObject pobj(cx, obj);
while (pobj && pobj->is<NativeObject>()) {
if (!pobj->hasInvalidatedTeleporting()) {
if (!JSObject::setInvalidatedTeleporting(cx, pobj)) {
return false;
}
}
pobj = pobj->staticPrototype();
}
return true;
}
static bool WatchProtoChangeImpl(JSContext* cx, HandleObject obj) {
if (!obj->isUsedAsPrototype()) {
return true;
}
if (!ReshapeForProtoMutation(cx, obj)) {
return false;
}
if (obj->is<NativeObject>()) {
InvalidateMegamorphicCache(cx, obj.as<NativeObject>());
}
return true;
}
// static
bool Watchtower::watchProtoChangeSlow(JSContext* cx, HandleObject obj) {
MOZ_ASSERT(watchesProtoChange(obj));
if (!WatchProtoChangeImpl(cx, obj)) {
return false;
}
if (MOZ_UNLIKELY(obj->useWatchtowerTestingLog())) {
if (!AddToWatchtowerLog(cx, "proto-change", obj,
JS::UndefinedHandleValue)) {
return false;
}
}
return true;
}
// static
bool Watchtower::watchPropertyRemoveSlow(JSContext* cx,
Handle<NativeObject*> obj,
HandleId id) {
MOZ_ASSERT(watchesPropertyRemove(obj));
if (obj->isUsedAsPrototype() && !id.isInt()) {
InvalidateMegamorphicCache(cx, obj);
}
if (obj->isGenerationCountedGlobal()) {
obj->as<GlobalObject>().bumpGenerationCount();
}
if (MOZ_UNLIKELY(obj->useWatchtowerTestingLog())) {
RootedValue val(cx, IdToValue(id));
if (!AddToWatchtowerLog(cx, "remove-prop", obj, val)) {
return false;
}
}
return true;
}
// static
bool Watchtower::watchPropertyChangeSlow(JSContext* cx,
Handle<NativeObject*> obj, HandleId id,
PropertyFlags flags) {
MOZ_ASSERT(watchesPropertyChange(obj));
if (obj->isUsedAsPrototype() && !id.isInt()) {
InvalidateMegamorphicCache(cx, obj);
}
if (obj->isGenerationCountedGlobal()) {
// The global generation counter only cares whether a property
// changes from data property to accessor or vice-versa. Changing
// the flags on a property doesn't matter.
uint32_t propIndex;
Rooted<PropMap*> map(cx, obj->shape()->lookup(cx, id, &propIndex));
MOZ_ASSERT(map);
PropertyInfo prop = map->getPropertyInfo(propIndex);
bool wasAccessor = prop.isAccessorProperty();
bool isAccessor = flags.isAccessorProperty();
if (wasAccessor != isAccessor) {
obj->as<GlobalObject>().bumpGenerationCount();
}
}
if (MOZ_UNLIKELY(obj->useWatchtowerTestingLog())) {
RootedValue val(cx, IdToValue(id));
if (!AddToWatchtowerLog(cx, "change-prop", obj, val)) {
return false;
}
}
return true;
}
// static
bool Watchtower::watchFreezeOrSealSlow(JSContext* cx,
Handle<NativeObject*> obj) {
MOZ_ASSERT(watchesFreezeOrSeal(obj));
if (MOZ_UNLIKELY(obj->useWatchtowerTestingLog())) {
if (!AddToWatchtowerLog(cx, "freeze-or-seal", obj,
JS::UndefinedHandleValue)) {
return false;
}
}
return true;
}
// static
bool Watchtower::watchObjectSwapSlow(JSContext* cx, HandleObject a,
HandleObject b) {
MOZ_ASSERT(watchesObjectSwap(a, b));
// If we're swapping an object that's used as prototype, we're mutating the
// proto chains of other objects. Treat this as a proto change to ensure we
// invalidate shape teleporting and megamorphic caches.
if (!WatchProtoChangeImpl(cx, a)) {
return false;
}
if (!WatchProtoChangeImpl(cx, b)) {
return false;
}
// Note: we don't invoke the testing callback for swap because the objects may
// not be safe to expose to JS at this point. See bug 1754699.
return true;
}
|