Bug 844059 - Prevent int-specialized GetElementIC to produce stub for float typed arrays. r=dvander
authorNicolas B. Pierron <nicolas.b.pierron@mozilla.com>
Mon, 25 Feb 2013 15:34:31 -0800
changeset 123046 729d41f6743b5e2711d530cc413f7499babb60a7
parent 123045 4b91cf1b0430921f322b244356770c625e1ec42f
child 123047 9c97e01125cc15fc83ec327bdc29980fc7d8f9bf
push id24372
push useremorley@mozilla.com
push dateWed, 27 Feb 2013 13:22:59 +0000
treeherdermozilla-central@0a91da5f5eab [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdvander
bugs844059
milestone22.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 844059 - Prevent int-specialized GetElementIC to produce stub for float typed arrays. r=dvander
js/src/ion/IonCaches.cpp
js/src/jit-test/tests/ion/bug844059.js
--- a/js/src/ion/IonCaches.cpp
+++ b/js/src/ion/IonCaches.cpp
@@ -1613,17 +1613,23 @@ GetElementIC::attachTypedArrayElement(JS
 {
     JS_ASSERT(obj->isTypedArray());
     JS_ASSERT(idval.isInt32());
 
     Label failures;
     MacroAssembler masm;
 
     // The array type is the object within the table of typed array classes.
-    int arrayType = obj->getClass() - &TypedArray::classes[0];
+    int arrayType = TypedArray::type(obj);
+
+    // The output register is not yet specialized as a float register, the only
+    // way to accept float typed arrays for now is to return a Value type.
+    bool floatOutput = arrayType == TypedArray::TYPE_FLOAT32 ||
+                       arrayType == TypedArray::TYPE_FLOAT64;
+    JS_ASSERT_IF(!output().hasValue(), !floatOutput);
 
     Register tmpReg = output().scratchReg().gpr();
     JS_ASSERT(tmpReg != InvalidReg);
 
     // Check that the typed array is of the same type as the current object
     // because load size differ in function of the typed array data width.
     masm.branchTestObjClass(Assembler::NotEqual, object(), tmpReg, obj->getClass(), &failures);
 
@@ -1718,19 +1724,24 @@ GetElementIC::update(JSContext *cx, size
                     return false;
                 attachedStub = true;
             }
         } else if (!cache.hasDenseStub() && obj->isNative() && idval.isInt32()) {
             if (!cache.attachDenseElement(cx, ion, obj, idval))
                 return false;
             attachedStub = true;
         } else if (obj->isTypedArray() && idval.isInt32()) {
-            if (!cache.attachTypedArrayElement(cx, ion, obj, idval))
-                return false;
-            attachedStub = true;
+            int arrayType = TypedArray::type(obj);
+            bool floatOutput = arrayType == TypedArray::TYPE_FLOAT32 ||
+                               arrayType == TypedArray::TYPE_FLOAT64;
+            if (!floatOutput || cache.output().hasValue()) {
+                if (!cache.attachTypedArrayElement(cx, ion, obj, idval))
+                    return false;
+                attachedStub = true;
+            }
         }
     }
 
     if (!GetElementOperation(cx, JSOp(*pc), &lval, idval, res))
         return false;
 
     // If no new attach was done, and we've reached maximum number of stubs, then
     // disable the cache.
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug844059.js
@@ -0,0 +1,12 @@
+
+function assertArraysFirstEqual(a, b) {
+    assertEq(a[0], b[0]);
+}
+
+function check(b) {
+    var a = deserialize(serialize(b));
+    assertArraysFirstEqual(a, b);
+}
+
+check(new Int8Array(1));
+check(new Float64Array(1));