Bug 923659 - IonMonkey: Set more precise ranges for MArrayLength and MInitializedLength. r=nbp
authorDan Gohman <sunfish@google.com>
Tue, 15 Oct 2013 20:49:43 -0700
changeset 164681 21f1754f307bbcb16847cc296ca2665a70d94b46
parent 164680 22e6f21251c929738ed884970d4c011c032dff18
child 164682 465f94eb495238c72b56ab54e17845e144a28efe
push id3066
push userakeybl@mozilla.com
push dateMon, 09 Dec 2013 19:58:46 +0000
treeherdermozilla-beta@a31a0dce83aa [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnbp
bugs923659
milestone27.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 923659 - IonMonkey: Set more precise ranges for MArrayLength and MInitializedLength. r=nbp
js/src/jit/RangeAnalysis.cpp
--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -1278,27 +1278,26 @@ MLoadTypedArrayElementStatic::computeRan
 {
     if (Range *range = GetTypedArrayRange(typedArray_->type()))
         setRange(range);
 }
 
 void
 MArrayLength::computeRange()
 {
-    Range *r = Range::NewUInt32Range(0, UINT32_MAX);
-    r->extendUInt32ToInt32Min();
-    setRange(r);
+    // Array lengths can go up to UINT32_MAX, but we only create MArrayLength
+    // nodes when the value is known to be int32 (see the
+    // OBJECT_FLAG_LENGTH_OVERFLOW flag).
+    setRange(Range::NewUInt32Range(0, INT32_MAX));
 }
 
 void
 MInitializedLength::computeRange()
 {
-    Range *r = Range::NewUInt32Range(0, UINT32_MAX);
-    r->extendUInt32ToInt32Min();
-    setRange(r);
+    setRange(Range::NewUInt32Range(0, JSObject::NELEMENTS_LIMIT));
 }
 
 void
 MTypedArrayLength::computeRange()
 {
     setRange(Range::NewUInt32Range(0, INT32_MAX));
 }