Bug 1266579 - Use jsop_newarray in inlineConstantStringSplitString. r=h4writer
authorTooru Fujisawa <arai_a@mac.com>
Tue, 26 Apr 2016 03:37:50 +0900
changeset 294815 054453fc28a53bc1aac8a76e5707aa604b37ceb6
parent 294814 aac06633cd1f9efac7f35641ea528642bdf2ab62
child 294816 57cda0f2a8375f794735ac6be51f929bf068ed14
push id30211
push userkwierso@gmail.com
push dateTue, 26 Apr 2016 00:12:12 +0000
treeherdermozilla-central@cfc7ebe59293 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersh4writer
bugs1266579
milestone48.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1266579 - Use jsop_newarray in inlineConstantStringSplitString. r=h4writer
js/src/jit-test/tests/auto-regress/bug1266579.js
js/src/jit/MCallOptimize.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug1266579.js
@@ -0,0 +1,28 @@
+function test1() {
+  do {
+    "8pan08pa8pan08pa".split("");
+  } while (!inIon());
+}
+
+function test2() {
+  do {
+    "abababababababababababababababab".split("a");
+  } while (!inIon());
+}
+
+function test3() {
+  do {
+    "abcabcabcabcabcabcabcabcabcabcabcabcabcabcabc".split("ab");
+  } while (!inIon());
+}
+
+function test4() {
+  do {
+    "".split("");
+  } while (!inIon());
+}
+
+test1();
+test2();
+test3();
+test4();
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -1442,45 +1442,43 @@ IonBuilder::inlineConstantStringSplitStr
     }
     callInfo.setImplicitlyUsedUnchecked();
 
     TemporaryTypeSet::DoubleConversion conversion =
             getInlineReturnTypeSet()->convertDoubleElements(constraints());
     if (conversion == TemporaryTypeSet::AlwaysConvertToDoubles)
         return InliningStatus_NotInlined;
 
-    MConstant* templateConst = MConstant::NewConstraintlessObject(alloc(), templateObject);
-    current->add(templateConst);
-
-    MNewArray* ins = MNewArray::New(alloc(), constraints(), initLength, templateConst,
-                                    templateObject->group()->initialHeap(constraints()), pc);
-
-    current->add(ins);
-    current->push(ins);
+    if (!jsop_newarray(templateObject, initLength))
+        return InliningStatus_Error;
+
+    MDefinition* array = current->peek(-1);
 
     if (!initLength) {
-        if (!resumeAfter(ins))
-            return InliningStatus_Error;
+        if (!array->isResumePoint()) {
+            if (!resumeAfter(array->toNewArray()))
+                return InliningStatus_Error;
+        }
         return InliningStatus_Inlined;
     }
 
     JSValueType unboxedType = GetBoxedOrUnboxedType(templateObject);
 
     // Store all values, no need to initialize the length after each as
     // jsop_initelem_array is doing because we do not expect to bailout
     // because the memory is supposed to be allocated by now.
     for (uint32_t i = 0; i < initLength; i++) {
        MConstant* value = arrayValues[i];
        current->add(value);
 
-       if (!initializeArrayElement(ins, i, value, unboxedType, /* addResumePoint = */ false))
+       if (!initializeArrayElement(array, i, value, unboxedType, /* addResumePoint = */ false))
            return InliningStatus_Error;
     }
 
-    MInstruction* setLength = setInitializedLength(ins, unboxedType, initLength);
+    MInstruction* setLength = setInitializedLength(array, unboxedType, initLength);
     if (!resumeAfter(setLength))
         return InliningStatus_Error;
 
     return InliningStatus_Inlined;
 }
 
 IonBuilder::InliningStatus
 IonBuilder::inlineStringSplitString(CallInfo& callInfo)