Merge.
authorAndreas Gal <gal@mozilla.com>
Wed, 17 Dec 2008 23:09:55 -0800
changeset 23090 59d774acdd37a9bda4e380dbe921d2b3ef450a6d
parent 23089 29d88d7860177b3e0a31257c24006eae2b969a6c (current diff)
parent 23088 cd92babb00cf3b218f2e7077dad596737920aa9e (diff)
child 23091 8353e26475a8866498ad1da8d2fa8848b9f033a5
push id4346
push userrsayre@mozilla.com
push dateFri, 26 Dec 2008 01:26:36 +0000
treeherdermozilla-central@8eb5a5b83a93 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone1.9.2a1pre
Merge.
js/src/jsinterp.cpp
js/src/jstracer.cpp
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -237,16 +237,18 @@ js_FillPropertyCache(JSContext *cx, JSOb
                     vword = JSVAL_OBJECT_TO_PCVAL(v);
                     break;
                 }
             }
         }
 
         /* If getting a value via a stub getter, we can cache the slot. */
         if (!(cs->format & JOF_SET) &&
+            !((cs->format & (JOF_INCDEC | JOF_FOR)) && 
+              (sprop->attrs & JSPROP_READONLY)) && 
             SPROP_HAS_STUB_GETTER(sprop) &&
             SPROP_HAS_VALID_SLOT(sprop, scope)) {
             /* Great, let's cache sprop's slot and use it on cache hit. */
             vword = SLOT_TO_PCVAL(sprop->slot);
         } else {
             /* Best we can do is to cache sprop (still a nice speedup). */
             vword = SPROP_TO_PCVAL(sprop);
         }
--- a/js/src/jsmath.cpp
+++ b/js/src/jsmath.cpp
@@ -225,20 +225,20 @@ math_atan2(JSContext *cx, uintN argc, js
     if (JSVAL_IS_NULL(vp[3]))
         return JS_FALSE;
     return js_NewNumberInRootedValue(cx, math_atan2_kernel (x, y), vp);
 }
 
 static inline jsdouble JS_FASTCALL
 math_ceil_kernel(jsdouble x)
 {
-#if defined(XP_MACOSX) || defined(DARWIN)
+#ifdef __APPLE__
     if (x < 0 && x > -1.0) 
         return js_copysign(0, -1);
-#endif    
+#endif
     return ceil(x);
 }
 
 static JSBool
 math_ceil(JSContext *cx, uintN argc, jsval *vp)
 {
     jsdouble x, z;
 
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -5084,23 +5084,25 @@ TraceRecorder::test_property_cache_direc
     /* Insist on obj being the directly addressed object. */
     if (obj2 != obj)
         ABORT_TRACE("test_property_cache_direct_slot hit prototype chain");
 
     /* Don't trace getter or setter calls, our caller wants a direct slot. */
     if (PCVAL_IS_SPROP(pcval)) {
         JSScopeProperty* sprop = PCVAL_TO_SPROP(pcval);
 
-        uint32 setflags = (js_CodeSpec[*cx->fp->regs->pc].format & (JOF_SET | JOF_INCDEC));
+        uint32 setflags = (js_CodeSpec[*cx->fp->regs->pc].format & (JOF_SET | JOF_INCDEC | JOF_FOR));
         if (setflags && !SPROP_HAS_STUB_SETTER(sprop))
             ABORT_TRACE("non-stub setter");
         if (setflags != JOF_SET && !SPROP_HAS_STUB_GETTER(sprop))
             ABORT_TRACE("non-stub getter");
         if (!SPROP_HAS_VALID_SLOT(sprop, OBJ_SCOPE(obj)))
             ABORT_TRACE("no valid slot");
+        if (setflags && (sprop->attrs & JSPROP_READONLY))
+            ABORT_TRACE("writing to a readonly property");
         slot = sprop->slot;
     } else {
         if (!PCVAL_IS_SLOT(pcval))
             ABORT_TRACE("PCE is not a slot");
         slot = PCVAL_TO_SLOT(pcval);
     }
     return true;
 }
@@ -6241,16 +6243,19 @@ TraceRecorder::record_SetPropHit(JSPropC
     jsbytecode* pc = cx->fp->regs->pc;
     jsval& r = stackval(-1);
     jsval& l = stackval(-2);
 
     JS_ASSERT(!JSVAL_IS_PRIMITIVE(l));
     JSObject* obj = JSVAL_TO_OBJECT(l);
     LIns* obj_ins = get(&l);
 
+    if (sprop->attrs & JSPROP_READONLY)
+        ABORT_TRACE("SetPropHit on readonly prop");
+
     if (obj == globalObj) {
         JS_ASSERT(SPROP_HAS_VALID_SLOT(sprop, OBJ_SCOPE(obj)));
         uint32 slot = sprop->slot;
         if (!lazilyImportGlobalSlot(slot))
             ABORT_TRACE("lazy import of global slot failed");
 
         LIns* r_ins = get(&r);
         set(&STOBJ_GET_SLOT(obj, slot), r_ins);
@@ -6833,17 +6838,17 @@ TraceRecorder::prop(JSObject* obj, LIns*
         v_ins = INS_CONST(JSVAL_TO_BOOLEAN(JSVAL_VOID));
         JS_ASSERT(cs.ndefs == 1);
         stack(-cs.nuses, v_ins);
         slot = SPROP_INVALID_SLOT;
         return true;
     }
 
     /* Insist if setting on obj being the directly addressed object. */
-    uint32 setflags = (cs.format & (JOF_SET | JOF_INCDEC));
+    uint32 setflags = (cs.format & (JOF_SET | JOF_INCDEC | JOF_FOR));
     LIns* dslots_ins = NULL;
     if (obj2 != obj) {
         if (setflags)
             ABORT_TRACE("JOF_SET opcode hit prototype chain");
 
         /*
          * We're getting a proto-property. Walk up the prototype chain emitting
          * proto slot loads, updating obj as we go, leaving obj set to obj2 with
@@ -6856,16 +6861,18 @@ TraceRecorder::prop(JSObject* obj, LIns*
     }
 
     /* Don't trace getter or setter calls, our caller wants a direct slot. */
     if (PCVAL_IS_SPROP(pcval)) {
         JSScopeProperty* sprop = PCVAL_TO_SPROP(pcval);
 
         if (setflags && !SPROP_HAS_STUB_SETTER(sprop))
             ABORT_TRACE("non-stub setter");
+        if (setflags && (sprop->attrs & JSPROP_READONLY))
+            ABORT_TRACE("writing to a readonly property");
         if (setflags != JOF_SET && !SPROP_HAS_STUB_GETTER(sprop)) {
             // FIXME 450335: generalize this away from regexp built-in getters.
             if (setflags == 0 &&
                 sprop->getter == js_RegExpClass.getProperty &&
                 sprop->shortid < 0) {
                 if (sprop->shortid == REGEXP_LAST_INDEX)
                     ABORT_TRACE("can't trace regexp.lastIndex yet");
                 LIns* args[] = { INS_CONSTPTR(sprop), obj_ins, cx_ins };