Bug 722023 - Only call GetElementIC::attachGetProp with named properties, not indexed properties. r=bhackett
authorJeff Walden <jwalden@mit.edu>
Sun, 29 Jan 2012 12:29:29 -0800
changeset 85792 02e01981f3629cd48dfce476489fce5d78feab6a
parent 85791 a5337afc5350a711ebce44d9e1644f5109818576
child 85793 0aacfba4caab859ad3d089f6ac5c285a9eaaef43
push id21960
push userbmo@edmorley.co.uk
push dateTue, 31 Jan 2012 10:53:23 +0000
treeherdermozilla-central@060de47a1822 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs722023
milestone12.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 722023 - Only call GetElementIC::attachGetProp with named properties, not indexed properties. r=bhackett
js/src/jit-test/tests/pic/getelem-large-index.js
js/src/methodjit/PolyIC.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/pic/getelem-large-index.js
@@ -0,0 +1,13 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+function testProperty(i)
+{
+  actual = obj[String(i)];
+}
+
+var obj = {};
+var index = [null, 1073741824, 1073741825];
+for (var j in index)
+  testProperty(index[j]);
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -2602,17 +2602,18 @@ LookupStatus
 GetElementIC::update(VMFrame &f, JSObject *obj, const Value &v, jsid id, Value *vp)
 {
     /*
      * Only treat this as a GETPROP for non-numeric string identifiers. The
      * GETPROP IC assumes the id has already gone through filtering for string
      * indexes in the emitter, i.e. js_GetProtoIfDenseArray is only valid to
      * use when looking up non-integer identifiers.
      */
-    if (v.isString() && js_CheckForStringIndex(id) == id)
+    uint32_t dummy;
+    if (v.isString() && JSID_IS_ATOM(id) && !JSID_TO_ATOM(id)->isIndex(&dummy))
         return attachGetProp(f, obj, v, JSID_TO_ATOM(id)->asPropertyName(), vp);
 
     if (obj->isArguments())
         return attachArguments(f, obj, v, id, vp);
 
 #if defined JS_METHODJIT_TYPED_ARRAY
     /*
      * Typed array ICs can make stub calls, and need to know which registers