Bug 842729 - Repair merge failures from bug 807853 in TypeOracle and MCallOptimize r=bhackett
authorNicholas D. Matsakis <nmatsakis@mozilla.com>
Tue, 19 Feb 2013 08:30:25 -0500
changeset 122496 c5c4c51585c30fc794d6e77f64c03a64ad62d3a9
parent 122495 bb29fef8cd2e6b63069df07660a6ac973e03b959
child 122497 9874a60b708f119ea30f9d2e52c9d81df32c7791
push id24342
push userryanvm@gmail.com
push dateThu, 21 Feb 2013 13:05:06 +0000
treeherdermozilla-central@702d2814efbf [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs842729, 807853
milestone22.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 842729 - Repair merge failures from bug 807853 in TypeOracle and MCallOptimize r=bhackett
js/src/ion/MCallOptimize.cpp
js/src/ion/TypeOracle.cpp
js/src/ion/TypeOracle.h
--- a/js/src/ion/MCallOptimize.cpp
+++ b/js/src/ion/MCallOptimize.cpp
@@ -875,53 +875,53 @@ IonBuilder::inlineUnsafeSetElement(CallI
      *
      * Here we inline each of the stores resulting from a call to
      * %UnsafeSetElement().  It is essential that these stores occur
      * atomically and cannot be interrupted by a stack or recursion
      * check.  If this is not true, race conditions can occur.
      */
 
     for (uint32_t base = 0; base < argc; base += 3) {
-        uint32_t arri = base + 1;
-        uint32_t idxi = base + 2;
+        uint32_t arri = base + 0;
+        uint32_t idxi = base + 1;
 
         types::StackTypeSet *obj = getInlineArgTypeSet(callInfo, arri);
         types::StackTypeSet *id = getInlineArgTypeSet(callInfo, idxi);
 
         int arrayType;
-        if (!oracle->elementAccessIsDenseNative(obj, id) &&
-            !oracle->elementAccessIsTypedArray(obj, id, &arrayType))
+        if (!oracle->elementWriteIsDenseNative(obj, id) &&
+            !oracle->elementWriteIsTypedArray(obj, id, &arrayType))
         {
             return InliningStatus_NotInlined;
         }
     }
 
     callInfo.unwrapArgs();
 
     // Push the result first so that the stack depth matches up for
     // the potential bailouts that will occur in the stores below.
     MConstant *udef = MConstant::New(UndefinedValue());
     current->add(udef);
     current->push(udef);
 
     for (uint32_t base = 0; base < argc; base += 3) {
-        uint32_t arri = base + 1;
-        uint32_t idxi = base + 2;
+        uint32_t arri = base + 0;
+        uint32_t idxi = base + 1;
 
         types::StackTypeSet *obj = getInlineArgTypeSet(callInfo, arri);
         types::StackTypeSet *id = getInlineArgTypeSet(callInfo, idxi);
 
-        if (oracle->elementAccessIsDenseNative(obj, id)) {
+        if (oracle->elementWriteIsDenseNative(obj, id)) {
             if (!inlineUnsafeSetDenseArrayElement(callInfo, base))
                 return InliningStatus_Error;
             continue;
         }
 
         int arrayType;
-        if (oracle->elementAccessIsTypedArray(obj, id, &arrayType)) {
+        if (oracle->elementWriteIsTypedArray(obj, id, &arrayType)) {
             if (!inlineUnsafeSetTypedArrayElement(callInfo, base, arrayType))
                 return InliningStatus_Error;
             continue;
         }
 
         JS_NOT_REACHED("Element access not dense array nor typed array");
     }
 
@@ -933,19 +933,19 @@ IonBuilder::inlineUnsafeSetDenseArrayEle
 {
     // Note: we do not check the conditions that are asserted as true
     // in intrinsic_UnsafeSetElement():
     // - arr is a dense array
     // - idx < initialized length
     // Furthermore, note that inference should be propagating
     // the type of the value to the JSID_VOID property of the array.
 
-    uint32_t arri = base + 1;
-    uint32_t idxi = base + 2;
-    uint32_t elemi = base + 3;
+    uint32_t arri = base + 0;
+    uint32_t idxi = base + 1;
+    uint32_t elemi = base + 2;
 
     MElements *elements = MElements::New(callInfo.getArg(arri));
     current->add(elements);
 
     MToInt32 *id = MToInt32::New(callInfo.getArg(idxi));
     current->add(id);
 
     // We disable the hole check for this store.  This implies that if
@@ -1068,18 +1068,20 @@ IonBuilder::inlineNewDenseArrayForParall
         return InliningStatus_NotInlined;
     types::TypeObject *typeObject = returnTypes->getTypeObject(0);
 
     RootedObject templateObject(cx, NewDenseAllocatedArray(cx, 0));
     if (!templateObject)
         return InliningStatus_Error;
     templateObject->setType(typeObject);
 
+    callInfo.unwrapArgs();
+
     MParNewDenseArray *newObject = new MParNewDenseArray(graph().parSlice(),
-                                                         callInfo.getArg(1),
+                                                         callInfo.getArg(0),
                                                          templateObject);
     current->add(newObject);
     current->push(newObject);
 
     return InliningStatus_Inlined;
 }
 
 IonBuilder::InliningStatus
--- a/js/src/ion/TypeOracle.cpp
+++ b/js/src/ion/TypeOracle.cpp
@@ -285,29 +285,42 @@ TypeInferenceOracle::inArrayIsPacked(Unr
 {
     StackTypeSet *types = script->analysis()->poppedTypes(pc, 0);
     return !types->hasObjectFlags(cx, types::OBJECT_FLAG_NON_PACKED);
 }
 
 bool
 TypeInferenceOracle::elementReadIsDenseNative(RawScript script, jsbytecode *pc)
 {
-    return elementAccessIsDenseNative(script->analysis()->poppedTypes(pc, 1),
-                                     script->analysis()->poppedTypes(pc, 0));
+    // Check whether the object is a dense array and index is int32 or double.
+    StackTypeSet *obj = script->analysis()->poppedTypes(pc, 1);
+    StackTypeSet *id = script->analysis()->poppedTypes(pc, 0);
+
+    JSValueType idType = id->getKnownTypeTag();
+    if (idType != JSVAL_TYPE_INT32 && idType != JSVAL_TYPE_DOUBLE)
+        return false;
+
+    Class *clasp = obj->getKnownClass();
+    return clasp && clasp->isNative();
 }
 
 bool
 TypeInferenceOracle::elementReadIsTypedArray(RawScript script, jsbytecode *pc, int *arrayType)
 {
-    if (!elementAccessIsTypedArray(script->analysis()->poppedTypes(pc, 1),
-                                   script->analysis()->poppedTypes(pc, 0),
-                                   arrayType))
-    {
+    // Check whether the object is a typed array and index is int32 or double.
+    StackTypeSet *obj = script->analysis()->poppedTypes(pc, 1);
+    StackTypeSet *id = DropUnrooted(script)->analysis()->poppedTypes(pc, 0);
+
+    JSValueType idType = id->getKnownTypeTag();
+    if (idType != JSVAL_TYPE_INT32 && idType != JSVAL_TYPE_DOUBLE)
         return false;
-    }
+
+    *arrayType = obj->getTypedArrayType();
+    if (*arrayType == TypedArray::TYPE_MAX)
+        return false;
 
     JS_ASSERT(*arrayType >= 0 && *arrayType < TypedArray::TYPE_MAX);
 
     // Unlike dense arrays, the types of elements in typed arrays are not
     // guaranteed to be present in the object's type, and we need to use
     // knowledge about the possible contents of the array vs. the types
     // that have been read out of it to figure out how to do the load.
     types::TypeSet *result = propertyRead(script, pc);
@@ -388,47 +401,47 @@ TypeInferenceOracle::elementReadGeneric(
         *monitorResult = (id == MIRType_String || script->analysis()->getCode(pc).getStringElement);
     else
         *monitorResult = true;
 }
 
 bool
 TypeInferenceOracle::elementWriteIsDenseNative(HandleScript script, jsbytecode *pc)
 {
-    return elementAccessIsDenseNative(script->analysis()->poppedTypes(pc, 2),
+    return elementWriteIsDenseNative(script->analysis()->poppedTypes(pc, 2),
                                      script->analysis()->poppedTypes(pc, 1));
 }
 
 bool
-TypeInferenceOracle::elementAccessIsDenseNative(StackTypeSet *obj, StackTypeSet *id)
+TypeInferenceOracle::elementWriteIsDenseNative(StackTypeSet *obj, StackTypeSet *id)
 {
+    // Check whether the object is a dense array and index is int32 or double.
     JSValueType idType = id->getKnownTypeTag();
     if (idType != JSVAL_TYPE_INT32 && idType != JSVAL_TYPE_DOUBLE)
         return false;
 
     Class *clasp = obj->getKnownClass();
     if (!clasp || !clasp->isNative())
         return false;
 
     return obj->convertDoubleElements(cx) != StackTypeSet::AmbiguousDoubleConversion;
 }
 
 bool
 TypeInferenceOracle::elementWriteIsTypedArray(RawScript script, jsbytecode *pc, int *arrayType)
 {
-    return elementAccessIsTypedArray(script->analysis()->poppedTypes(pc, 2),
-                                     script->analysis()->poppedTypes(pc, 1),
-                                     arrayType);
+    return elementWriteIsTypedArray(script->analysis()->poppedTypes(pc, 2),
+                                    script->analysis()->poppedTypes(pc, 1),
+                                    arrayType);
 }
 
 bool
-TypeInferenceOracle::elementAccessIsTypedArray(StackTypeSet *obj, StackTypeSet *id, int *arrayType)
+TypeInferenceOracle::elementWriteIsTypedArray(StackTypeSet *obj, StackTypeSet *id, int *arrayType)
 {
     // Check whether the object is a typed array and index is int32 or double.
-
     JSValueType idType = id->getKnownTypeTag();
     if (idType != JSVAL_TYPE_INT32 && idType != JSVAL_TYPE_DOUBLE)
         return false;
 
     *arrayType = obj->getTypedArrayType();
     if (*arrayType == TypedArray::TYPE_MAX)
         return false;
 
--- a/js/src/ion/TypeOracle.h
+++ b/js/src/ion/TypeOracle.h
@@ -106,34 +106,34 @@ class TypeOracle
         *intIndex = false;
     }
     virtual bool setElementHasWrittenHoles(UnrootedScript script, jsbytecode *pc) {
         return true;
     }
     virtual bool elementWriteIsDenseNative(HandleScript script, jsbytecode *pc) {
         return false;
     }
+    virtual bool elementWriteIsDenseNative(types::StackTypeSet *obj, types::StackTypeSet *id) {
+        return false;
+    }
     virtual bool elementWriteIsTypedArray(RawScript script, jsbytecode *pc, int *arrayType) {
         return false;
     }
+    virtual bool elementWriteIsTypedArray(types::StackTypeSet *obj, types::StackTypeSet *id, int *arrayType) {
+        return false;
+    }
     virtual bool elementWriteNeedsDoubleConversion(UnrootedScript script, jsbytecode *pc) {
         return false;
     }
     virtual bool elementWriteHasExtraIndexedProperty(RawScript script, jsbytecode *pc) {
         return false;
     }
     virtual bool elementWriteIsPacked(RawScript script, jsbytecode *pc) {
         return false;
     }
-    virtual bool elementAccessIsDenseNative(types::StackTypeSet *obj, types::StackTypeSet *id) {
-        return false;
-    }
-    virtual bool elementAccessIsTypedArray(types::StackTypeSet *obj, types::StackTypeSet *id, int *arrayType) {
-        return false;
-    }
     virtual bool arrayResultShouldHaveDoubleConversion(UnrootedScript script, jsbytecode *pc) {
         return false;
     }
     virtual bool propertyWriteCanSpecialize(UnrootedScript script, jsbytecode *pc) {
         return true;
     }
     virtual bool propertyWriteNeedsBarrier(UnrootedScript script, jsbytecode *pc, RawId id) {
         return true;
@@ -254,19 +254,19 @@ class TypeInferenceOracle : public TypeO
     bool elementReadIsDenseNative(RawScript script, jsbytecode *pc);
     bool elementReadIsTypedArray(RawScript script, jsbytecode *pc, int *atype);
     bool elementReadIsString(UnrootedScript script, jsbytecode *pc);
     bool elementReadShouldAlwaysLoadDoubles(UnrootedScript script, jsbytecode *pc);
     bool elementReadHasExtraIndexedProperty(UnrootedScript, jsbytecode *pc);
     bool elementReadIsPacked(UnrootedScript script, jsbytecode *pc);
     void elementReadGeneric(UnrootedScript script, jsbytecode *pc, bool *cacheable, bool *monitorResult, bool *intIndex);
     bool elementWriteIsDenseNative(HandleScript script, jsbytecode *pc);
-    bool elementAccessIsDenseNative(types::StackTypeSet *obj, types::StackTypeSet *id);
+    bool elementWriteIsDenseNative(types::StackTypeSet *obj, types::StackTypeSet *id);
     bool elementWriteIsTypedArray(RawScript script, jsbytecode *pc, int *arrayType);
-    bool elementAccessIsTypedArray(types::StackTypeSet *obj, types::StackTypeSet *id, int *arrayType);
+    bool elementWriteIsTypedArray(types::StackTypeSet *obj, types::StackTypeSet *id, int *arrayType);
     bool elementWriteNeedsDoubleConversion(UnrootedScript script, jsbytecode *pc);
     bool elementWriteHasExtraIndexedProperty(RawScript script, jsbytecode *pc);
     bool elementWriteIsPacked(RawScript script, jsbytecode *pc);
     bool arrayResultShouldHaveDoubleConversion(UnrootedScript script, jsbytecode *pc);
     bool setElementHasWrittenHoles(UnrootedScript script, jsbytecode *pc);
     bool propertyWriteCanSpecialize(UnrootedScript script, jsbytecode *pc);
     bool propertyWriteNeedsBarrier(UnrootedScript script, jsbytecode *pc, RawId id);
     bool elementWriteNeedsBarrier(UnrootedScript script, jsbytecode *pc);