Bug 742393 - Don't inline array.concat if the array prototype has indexed properties. r=bhackett
authorJan de Mooij <jdemooij@mozilla.com>
Wed, 11 Apr 2012 18:49:42 +0200
changeset 94752 5ddad68924667242e390e3d87e933a6843827d5a
parent 94751 8b85ca762178af4ec66e8a16370810c65548c508
child 94753 e31de91d13cc0f4f87d052f72270f82cb20fd00d
push id886
push userlsblakk@mozilla.com
push dateMon, 04 Jun 2012 19:57:52 +0000
treeherdermozilla-beta@bbd8d5efd6d1 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs742393
milestone14.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 742393 - Don't inline array.concat if the array prototype has indexed properties. r=bhackett
js/src/jit-test/tests/jaeger/bug742393.js
js/src/methodjit/FastBuiltins.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/bug742393.js
@@ -0,0 +1,11 @@
+var global = 0;
+Object.defineProperty(Array.prototype, "2", {get: function() { return global++; }});
+
+function f() {
+    var a = [];
+    var b = [0, 1, , 3];
+    for (var i=0; i<100; i++)
+        var c = a.concat(b);
+    assertEq(c[2], 99);
+}
+f();
--- a/js/src/methodjit/FastBuiltins.cpp
+++ b/js/src/methodjit/FastBuiltins.cpp
@@ -1025,17 +1025,19 @@ mjit::Compiler::inlineNativeFunction(uin
             if (!thisTypes->hasObjectFlags(cx, types::OBJECT_FLAG_NON_DENSE_ARRAY) &&
                 !types::ArrayPrototypeHasIndexedProperty(cx, outerScript)) {
                 return compileArrayPush(thisValue, arg);
             }
         }
         if (native == js::array_concat && argType == JSVAL_TYPE_OBJECT &&
             thisType == JSVAL_TYPE_OBJECT && type == JSVAL_TYPE_OBJECT &&
             !thisTypes->hasObjectFlags(cx, types::OBJECT_FLAG_NON_DENSE_ARRAY) &&
-            !argTypes->hasObjectFlags(cx, types::OBJECT_FLAG_NON_DENSE_ARRAY)) {
+            !argTypes->hasObjectFlags(cx, types::OBJECT_FLAG_NON_DENSE_ARRAY) &&
+            !types::ArrayPrototypeHasIndexedProperty(cx, outerScript))
+        {
             return compileArrayConcat(thisTypes, argTypes, thisValue, arg);
         }
     } else if (argc == 2) {
         FrameEntry *arg1 = frame.peek(-2);
         FrameEntry *arg2 = frame.peek(-1);
 
         JSValueType arg1Type = arg1->isTypeKnown() ? arg1->getKnownType() : JSVAL_TYPE_UNKNOWN;
         JSValueType arg2Type = arg2->isTypeKnown() ? arg2->getKnownType() : JSVAL_TYPE_UNKNOWN;