Bug 1500052 - Fix iterator cache to check getDenseInitializedLength() == 0 instead of hasEmptyElements(). r=evilpie
authorJan de Mooij <jdemooij@mozilla.com>
Thu, 18 Oct 2018 14:24:45 +0000
changeset 497678 609976e5c798f029adf1339e4298d0747fb360bc
parent 497677 2025f3b4871b7030c10a69b2386d1fe406774bf8
child 497679 77d3179f96db09f41d591b62d341ba53604bc24c
push id10002
push userarchaeopteryx@coole-files.de
push dateFri, 19 Oct 2018 23:09:29 +0000
treeherdermozilla-beta@01378c910610 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersevilpie
bugs1500052
milestone64.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1500052 - Fix iterator cache to check getDenseInitializedLength() == 0 instead of hasEmptyElements(). r=evilpie hasEmptyElements() is too pessimistic: arrays often have no elements but aren't using the empty elements singleton. Differential Revision: https://phabricator.services.mozilla.com/D9083
js/src/vm/Iteration.cpp
--- a/js/src/vm/Iteration.cpp
+++ b/js/src/vm/Iteration.cpp
@@ -832,21 +832,21 @@ IteratorHashPolicy::match(PropertyIterat
     return ArrayEqual(reinterpret_cast<ReceiverGuard*>(ni->guardsBegin()), lookup.guards,
                       ni->guardCount());
 }
 
 static inline bool
 CanCompareIterableObjectToCache(JSObject* obj)
 {
     if (obj->isNative()) {
-        return obj->as<NativeObject>().hasEmptyElements();
+        return obj->as<NativeObject>().getDenseInitializedLength() == 0;
     }
     if (obj->is<UnboxedPlainObject>()) {
         if (UnboxedExpandoObject* expando = obj->as<UnboxedPlainObject>().maybeExpando()) {
-            return expando->hasEmptyElements();
+            return expando->getDenseInitializedLength() == 0;
         }
         return true;
     }
     return false;
 }
 
 using ReceiverGuardVector = Vector<ReceiverGuard, 8>;
 
@@ -894,17 +894,17 @@ LookupInIteratorCache(JSContext* cx, JSO
     return iterobj;
 }
 
 static bool
 CanStoreInIteratorCache(JSObject* obj)
 {
     do {
         if (obj->isNative()) {
-            MOZ_ASSERT(obj->as<NativeObject>().hasEmptyElements());
+            MOZ_ASSERT(obj->as<NativeObject>().getDenseInitializedLength() == 0);
 
             // Typed arrays have indexed properties not captured by the Shape guard.
             // Enumerate hooks may add extra properties.
             const Class* clasp = obj->getClass();
             if (MOZ_UNLIKELY(IsTypedArrayClass(clasp))) {
                 return false;
             }
             if (MOZ_UNLIKELY(clasp->getNewEnumerate() || clasp->getEnumerate())) {