Compile JSOP_INITPROP (bug 728290 part 2, r=dvander)
authorJan de Mooij <jdemooij@mozilla.com>
Tue, 28 Feb 2012 14:22:01 +0100
changeset 88933 abb6b44448af9d0604d9e3430bbf88b1b38ea079
parent 88932 7fc13fbbc3308e67f0b5bf4f0c83cc46c4bbbb6e
child 88934 0c780caf3eb66016173de53e317152ea16d505db
push id656
push userjandemooij@gmail.com
push dateTue, 28 Feb 2012 13:24:03 +0000
reviewersdvander
bugs728290
milestone13.0a1
Compile JSOP_INITPROP (bug 728290 part 2, r=dvander)
js/src/ion/IonBuilder.cpp
js/src/ion/IonBuilder.h
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -732,16 +732,19 @@ IonBuilder::inspectOpcode(JSOp op)
         return jsop_newarray(GET_UINT24(pc));
 
       case JSOP_NEWOBJECT:
         return jsop_newobject(info().getObject(pc));
 
       case JSOP_INITELEM:
         return jsop_initelem();
 
+      case JSOP_INITPROP:
+        return jsop_initprop(info().getAtom(pc));
+
       case JSOP_ENDINIT:
         return true;
 
       case JSOP_CALL:
       case JSOP_FUNCALL:
       case JSOP_FUNAPPLY:
         return jsop_call(GET_ARGC(pc), false);
 
@@ -2659,16 +2662,51 @@ IonBuilder::jsop_initelem_dense()
     current->add(initLength);
 
     if (!resumeAfter(initLength))
         return false;
 
    return true;
 }
 
+bool
+IonBuilder::jsop_initprop(JSAtom *atom)
+{
+    MDefinition *value = current->pop();
+    MDefinition *obj = current->peek(-1);
+
+    JSObject *baseObj = obj->toNewObject()->baseObj();
+
+    if (!oracle->propertyWriteCanSpecialize(script, pc)) {
+        // This should only happen for a few names like __proto__.
+        return abort("INITPROP Monitored initprop");
+    }
+
+    JSObject *holder;
+    JSProperty *prop = NULL;
+    DebugOnly<bool> res = LookupPropertyWithFlags(cx, baseObj, ATOM_TO_JSID(atom),
+                                                  JSRESOLVE_QUALIFIED, &holder, &prop);
+    JS_ASSERT(res && prop && holder == baseObj);
+
+    Shape *shape = (Shape *)prop;
+
+    if (baseObj->isFixedSlot(shape->slot())) {
+        MStoreFixedSlot *store = MStoreFixedSlot::New(obj, value, shape->slot());
+        current->add(store);
+        return resumeAfter(store);
+    }
+
+    MSlots *slots = MSlots::New(obj);
+    current->add(slots);
+
+    MStoreSlot *store = MStoreSlot::New(slots, shape->slot(), value);
+    current->add(store);
+    return resumeAfter(store);
+}
+
 MBasicBlock *
 IonBuilder::addBlock(MBasicBlock *block, uint32 loopDepth)
 {
     if (!block)
         return NULL;
     graph().addBlock(block);
     block->setLoopDepth(loopDepth);
     return block;
--- a/js/src/ion/IonBuilder.h
+++ b/js/src/ion/IonBuilder.h
@@ -309,16 +309,17 @@ class IonBuilder : public MIRGenerator
     bool jsop_length_fastPath();
     bool jsop_not();
     bool jsop_getprop(JSAtom *atom);
     bool jsop_setprop(JSAtom *atom);
     bool jsop_newarray(uint32 count);
     bool jsop_newobject(JSObject *baseObj);
     bool jsop_initelem();
     bool jsop_initelem_dense();
+    bool jsop_initprop(JSAtom *atom);
     bool jsop_regexp(RegExpObject *reobj);
     bool jsop_object(JSObject *obj);
     bool jsop_lambda(JSFunction *fun);
     bool jsop_deflocalfun(uint32 local, JSFunction *fun);
     bool jsop_this();
     bool jsop_typeof();
     bool jsop_toid();
     bool jsop_iter(uint8 flags);