Backed out changeset 7e831598f812 due to tinderbox oranges.
authorNicholas Nethercote <nnethercote@mozilla.com>
Tue, 28 Sep 2010 22:39:19 -0700
changeset 54765 a5a8e15b15c9660506eb24087612e5f1a9e6be20
parent 54762 7e831598f81295b210c8f35414c904a6db5403d0
child 54766 7dcc52c49fc4956acbfeea217fd180c6d60e6fc1
push id1
push userroot
push dateMon, 20 Oct 2014 17:29:22 +0000
milestone2.0b7pre
backs out7e831598f81295b210c8f35414c904a6db5403d0
Backed out changeset 7e831598f812 due to tinderbox oranges.
js/src/jstracer.cpp
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -8409,18 +8409,17 @@ TraceRecorder::alu(LOpcode v, jsdouble v
         /* If the result is not 0, it is always within the integer domain. */
         LIns* branch = lir->insBranch(LIR_jf, lir->insEqI_0(result), NULL);
 
         /*
          * If the result is zero, we must exit if the lhs is negative since
          * the result is -0 in this case, which is not in the integer domain.
          */
         guard(false, lir->ins2ImmI(LIR_lti, d0, 0), exit);
-        if (branch)
-            branch->setTarget(lir->ins0(LIR_label));
+        branch->setTarget(lir->ins0(LIR_label));
         break;
       }
 #endif
 
       default:
         v = arithOpcodeD2I(v);
         JS_ASSERT(v == LIR_addi || v == LIR_muli || v == LIR_subi);
 
@@ -12944,35 +12943,26 @@ TraceRecorder::setElem(int lval_spindex,
              * machines.
              */
             guard(true, lir->ins2ImmI(LIR_gei, idx_ins, 0), mismatchExit);
         }
 
         if (!js_EnsureDenseArrayCapacity(cx, obj, idx.toInt32()))
             RETURN_STOP_A("couldn't ensure dense array capacity for setelem");
 
+        // Grow the array if the index exceeds the capacity.  This happens
+        // rarely, eg. less than 1% of the time in SunSpider.
         LIns* capacity_ins =
             addName(stobj_get_fslot_uint32(obj_ins, JSObject::JSSLOT_DENSE_ARRAY_CAPACITY),
                     "capacity");
-        LIns* inRange_ins = lir->ins2(LIR_ltui, idx_ins, capacity_ins);
-        if (inRange_ins->isImmI()) {
-            // The (index < capacity) check can be converted to a constant 1
-            // if it's subsumed by a previous guard, in which case we don't
-            // need to re-check.  It should not have been converted to a
-            // constant 0.
-            JS_ASSERT(inRange_ins->immI() == 1);
-        } else {
-            // Grow the array if (index >= capacity).  This happens rarely,
-            // eg. less than 1% of the time in SunSpider.
-            LIns* br = lir->insBranch(LIR_jt, lir->ins2(LIR_ltui, idx_ins, capacity_ins), NULL);
-            LIns* args[] = { idx_ins, obj_ins, cx_ins };
-            LIns* res_ins = lir->insCall(&js_EnsureDenseArrayCapacity_ci, args);
-            guard(false, lir->insEqI_0(res_ins), mismatchExit);
-            br->setTarget(lir->ins0(LIR_label));
-        }
+        LIns* br = lir->insBranch(LIR_jt, lir->ins2(LIR_ltui, idx_ins, capacity_ins), NULL);
+        LIns* args[] = { idx_ins, obj_ins, cx_ins };
+        LIns* res_ins = lir->insCall(&js_EnsureDenseArrayCapacity_ci, args);
+        guard(false, lir->insEqI_0(res_ins), mismatchExit);
+        br->setTarget(lir->ins0(LIR_label));
 
         // Get the address of the element.
         LIns *dslots_ins =
             addName(lir->insLoad(LIR_ldp, obj_ins, offsetof(JSObject, dslots), ACCSET_OTHER), "dslots");
         JS_ASSERT(sizeof(Value) == 8); // The |3| in the following statement requires this.
         LIns *addr_ins = lir->ins2(LIR_addp, dslots_ins,
                                    lir->ins2ImmI(LIR_lshp, lir->insUI2P(idx_ins), 3));
 
@@ -12990,18 +12980,17 @@ TraceRecorder::setElem(int lval_spindex,
                                                                 JSVAL_TAG_SHIFT)),
 #endif
                                INS_CONSTU(JSVAL_TAG_MAGIC));
         LIns* br2 = lir->insBranch(LIR_jf, cond, NULL);
         LIns* args2[] = { idx_ins, obj_ins, cx_ins };
         LIns* res_ins2 = addName(lir->insCall(&js_Array_dense_setelem_hole_ci, args2),
                                  "hasNoIndexedProperties");
         guard(false, lir->insEqI_0(res_ins2), mismatchExit);
-        if (br2)
-            br2->setTarget(lir->ins0(LIR_label));
+        br2->setTarget(lir->ins0(LIR_label));
 
         // Right, actually set the element.
         box_value_into(v, v_ins, addr_ins, 0, ACCSET_OTHER);
     }
 
     jsbytecode* pc = cx->regs->pc;
     if (*pc == JSOP_SETELEM && pc[JSOP_SETELEM_LENGTH] != JSOP_POP)
         set(&lval, v_ins);