Bug 732693 - Fix bytecode emitted for o.__proto__(). r=bhackett
authorJan de Mooij <jdemooij@mozilla.com>
Sat, 03 Mar 2012 16:27:51 +0100
changeset 88209 55e360715d7676060b99db6b3319b04c92d57521
parent 88208 7c62688f88fa5cb3f5afaa580ebbd97be018c0bc
child 88210 baec1efc87a4c48183b4e7bfbe1ba8d319a631df
child 88215 c51dbd19871b64531b2e24d1bbebb6fe3d35e29f
push id22175
push userbmo@edmorley.co.uk
push dateSun, 04 Mar 2012 00:39:10 +0000
treeherdermozilla-central@baec1efc87a4 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs732693
milestone13.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 732693 - Fix bytecode emitted for o.__proto__(). r=bhackett
js/src/frontend/BytecodeEmitter.cpp
js/src/jit-test/tests/basic/bug732693.js
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -1912,32 +1912,26 @@ EmitElemOpBase(JSContext *cx, BytecodeEm
 static bool
 EmitSpecialPropOp(JSContext *cx, ParseNode *pn, JSOp op, BytecodeEmitter *bce)
 {
     /*
      * Special case for obj.__proto__ to deoptimize away from fast paths in the
      * interpreter and trace recorder, which skip dense array instances by
      * going up to Array.prototype before looking up the property name.
      */
+    if (op == JSOP_CALLELEM && Emit1(cx, bce, JSOP_DUP) < 0)
+        return false;
+
     jsatomid index;
     if (!bce->makeAtomIndex(pn->pn_atom, &index))
         return false;
     if (!EmitIndex32(cx, JSOP_QNAMEPART, index, bce))
         return false;
 
-    if (op == JSOP_CALLELEM && Emit1(cx, bce, JSOP_DUP) < 0)
-        return false;
-
-    if (!EmitElemOpBase(cx, bce, op))
-        return false;
-
-    if (op == JSOP_CALLELEM && Emit1(cx, bce, JSOP_SWAP) < 0)
-        return false;
-
-    return true;
+    return EmitElemOpBase(cx, bce, op);
 }
 
 static bool
 EmitPropOp(JSContext *cx, ParseNode *pn, JSOp op, BytecodeEmitter *bce,
            JSBool callContext)
 {
     ParseNode *pn2, *pndot, *pnup, *pndown;
     ptrdiff_t top;
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug732693.js
@@ -0,0 +1,10 @@
+var res = 0;
+var o = {__proto__: function() { res++; }};
+
+function f() {
+    for (var i=0; i<70; i++) {
+        o.__proto__();
+    }
+}
+f();
+assertEq(res, 70);