Bug 1404636 - Special-case typed arrays in PropertyReadNeedsTypeBarrier. r=bhackett, a=lizzard
authorJan de Mooij <jdemooij@mozilla.com>
Thu, 26 Oct 2017 16:15:35 +0200
changeset 432774 00e60f48b78d572472bffa2304f536552d2c5483
parent 432773 7eac5fd072cbe24564f884d6b4e1c82bfb94790c
child 432775 c0467da2b62efb2019aeef358cb942e1586e6510
push id8056
push userryanvm@gmail.com
push dateThu, 26 Oct 2017 15:24:01 +0000
treeherdermozilla-beta@5f5a87b79586 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett, lizzard
bugs1404636
milestone57.0
Bug 1404636 - Special-case typed arrays in PropertyReadNeedsTypeBarrier. r=bhackett, a=lizzard
js/src/jit/IonBuilder.cpp
js/src/jit/MIR.cpp
js/src/jit/MIR.h
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -7820,19 +7820,16 @@ IonBuilder::getElemTryTypedObject(bool* 
                                                     index,
                                                     objPrediction,
                                                     elemPrediction);
     }
 
     MOZ_CRASH("Bad kind");
 }
 
-static MIRType
-MIRTypeForTypedArrayRead(Scalar::Type arrayType, bool observedDouble);
-
 bool
 IonBuilder::checkTypedObjectIndexInBounds(uint32_t elemSize,
                                           MDefinition* obj,
                                           MDefinition* index,
                                           TypedObjectPrediction objPrediction,
                                           LinearSum* indexAsByteOffset)
 {
     // Ensure index is an integer.
@@ -8788,39 +8785,16 @@ IonBuilder::convertShiftToMaskForStaticT
     MOZ_ASSERT(!ptr->isEffectful());
 
     current->add(mask);
     current->add(ptr);
 
     return ptr;
 }
 
-static MIRType
-MIRTypeForTypedArrayRead(Scalar::Type arrayType, bool observedDouble)
-{
-    switch (arrayType) {
-      case Scalar::Int8:
-      case Scalar::Uint8:
-      case Scalar::Uint8Clamped:
-      case Scalar::Int16:
-      case Scalar::Uint16:
-      case Scalar::Int32:
-        return MIRType::Int32;
-      case Scalar::Uint32:
-        return observedDouble ? MIRType::Double : MIRType::Int32;
-      case Scalar::Float32:
-        return MIRType::Float32;
-      case Scalar::Float64:
-        return MIRType::Double;
-      default:
-        break;
-    }
-    MOZ_CRASH("Unknown typed array type");
-}
-
 AbortReasonOr<Ok>
 IonBuilder::jsop_getelem_typed(MDefinition* obj, MDefinition* index,
                                Scalar::Type arrayType)
 {
     TemporaryTypeSet* types = bytecodeTypes(pc);
 
     bool maybeUndefined = types->hasType(TypeSet::UndefinedType());
 
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -6230,16 +6230,24 @@ PropertyReadNeedsTypeBarrier(CompilerCon
     // We also need a barrier if the object is a proxy, because then all bets
     // are off, just as if it has unknown properties.
     if (key->unknownProperties() || observed->empty() ||
         key->clasp()->isProxy())
     {
         return BarrierKind::TypeSet;
     }
 
+    if (!name && IsTypedArrayClass(key->clasp())) {
+        Scalar::Type arrayType = Scalar::Type(key->clasp() - &TypedArrayObject::classes[0]);
+        MIRType type = MIRTypeForTypedArrayRead(arrayType, true);
+        if (observed->mightBeMIRType(type))
+            return BarrierKind::NoBarrier;
+        return BarrierKind::TypeSet;
+    }
+
     jsid id = name ? NameToId(name) : JSID_VOID;
     HeapTypeSetKey property = key->property(id);
     if (property.maybeTypes()) {
         if (!TypeSetIncludes(observed, MIRType::Value, property.maybeTypes())) {
             // If all possible objects have been observed, we don't have to
             // guard on the specific object types.
             if (property.maybeTypes()->objectsAreSubset(observed)) {
                 property.freeze(constraints);
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -15102,16 +15102,39 @@ bool PropertyWriteNeedsTypeBarrier(TempA
                                    MBasicBlock* current, MDefinition** pobj,
                                    PropertyName* name, MDefinition** pvalue,
                                    bool canModify, MIRType implicitType = MIRType::None);
 AbortReasonOr<bool>
 ArrayPrototypeHasIndexedProperty(IonBuilder* builder, JSScript* script);
 AbortReasonOr<bool>
 TypeCanHaveExtraIndexedProperties(IonBuilder* builder, TemporaryTypeSet* types);
 
+inline MIRType
+MIRTypeForTypedArrayRead(Scalar::Type arrayType, bool observedDouble)
+{
+    switch (arrayType) {
+      case Scalar::Int8:
+      case Scalar::Uint8:
+      case Scalar::Uint8Clamped:
+      case Scalar::Int16:
+      case Scalar::Uint16:
+      case Scalar::Int32:
+        return MIRType::Int32;
+      case Scalar::Uint32:
+        return observedDouble ? MIRType::Double : MIRType::Int32;
+      case Scalar::Float32:
+        return MIRType::Float32;
+      case Scalar::Float64:
+        return MIRType::Double;
+      default:
+        break;
+    }
+    MOZ_CRASH("Unknown typed array type");
+}
+
 } // namespace jit
 } // namespace js
 
 // Specialize the AlignmentFinder class to make Result<V, E> works with abstract
 // classes such as MDefinition*, and MInstruction*
 namespace mozilla
 {