Bug 959161 - Also use eager allocation for Array(x) inlined in Ion. r=luke
authorJan de Mooij <jdemooij@mozilla.com>
Sat, 18 Jan 2014 14:11:11 +0100
changeset 164139 cc0ba35ea087eaf6acef269938210961f3134256
parent 164138 56f89ea332f75e67657fbadf81d1370a31f68267
child 164140 239b4d95624a6a9538cba0376d2fb5bc91f55757
push id26026
push userphilringnalda@gmail.com
push dateSat, 18 Jan 2014 23:17:27 +0000
treeherdermozilla-central@61fd0f987cf2 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersluke
bugs959161
milestone29.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 959161 - Also use eager allocation for Array(x) inlined in Ion. r=luke
js/src/jit/MCallOptimize.cpp
js/src/jsarray.cpp
js/src/vm/ArrayObject.h
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -242,16 +242,19 @@ IonBuilder::inlineArray(CallInfo &callIn
         MDefinition *arg = callInfo.getArg(0);
         if (!arg->isConstant())
             return InliningStatus_NotInlined;
 
         // Negative lengths generate a RangeError, unhandled by the inline path.
         initLength = arg->toConstant()->value().toInt32();
         if (initLength >= JSObject::NELEMENTS_LIMIT)
             return InliningStatus_NotInlined;
+
+        if (initLength <= ArrayObject::EagerAllocationMaxLength)
+            allocating = MNewArray::NewArray_Allocating;
     }
 
     callInfo.setImplicitlyUsedUnchecked();
 
     types::TemporaryTypeSet::DoubleConversion conversion =
         getInlineReturnTypeSet()->convertDoubleElements(constraints());
     {
         AutoThreadSafeAccess ts(templateObject);
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -3041,20 +3041,18 @@ js_Array(JSContext *cx, unsigned argc, V
             return false;
         }
     }
 
     /*
      * Allocate dense elements eagerly for small arrays, to avoid reallocating
      * elements when filling the array.
      */
-    static const uint32_t ArrayEagerAllocationMaxLength = 2048;
-
     RootedObject obj(cx);
-    obj = (length <= ArrayEagerAllocationMaxLength)
+    obj = (length <= ArrayObject::EagerAllocationMaxLength)
           ? NewDenseAllocatedArray(cx, length)
           : NewDenseUnallocatedArray(cx, length);
     if (!obj)
         return false;
     Rooted<ArrayObject*> arr(cx, &obj->as<ArrayObject>());
 
     arr->setType(type);
 
--- a/js/src/vm/ArrayObject.h
+++ b/js/src/vm/ArrayObject.h
@@ -9,16 +9,19 @@
 
 #include "jsobj.h"
 
 namespace js {
 
 class ArrayObject : public JSObject
 {
   public:
+    // Array(x) eagerly allocates dense elements if x <= this value.
+    static const uint32_t EagerAllocationMaxLength = 2048;
+
     static const Class class_;
 
     bool lengthIsWritable() const {
         return !getElementsHeader()->hasNonwritableArrayLength();
     }
 
     uint32_t length() const {
         return getElementsHeader()->length;