Bug 867482. r=bhackett
authorJan de Mooij <jdemooij@mozilla.com>
Thu, 02 May 2013 11:48:02 +0200
changeset 141536 7c9e2aa0dd8a37c7cf84f80987d8c1a3571e5c50
parent 141535 85430cf0c1a76aca5a707959db21fab1d236fe90
child 141537 b3df3d58f20c4b563f667a1b38336bbfe325df0f
push id2579
push userakeybl@mozilla.com
push dateMon, 24 Jun 2013 18:52:47 +0000
treeherdermozilla-beta@b69b7de8a05a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs867482
milestone23.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 867482. r=bhackett
js/src/ion/MCallOptimize.cpp
js/src/methodjit/FastBuiltins.cpp
--- a/js/src/ion/MCallOptimize.cpp
+++ b/js/src/ion/MCallOptimize.cpp
@@ -405,16 +405,24 @@ IonBuilder::inlineArrayConcat(CallInfo &
     types::TypeObject *thisType = thisTypes->getTypeObject(0);
     if (!thisType ||
         thisType->unknownProperties() ||
         &thisType->proto->global() != &script->global())
     {
         return InliningStatus_NotInlined;
     }
 
+    // Don't inline if 'this' is packed and the argument may not be packed
+    // (the result array will reuse the 'this' type).
+    if (!thisTypes->hasObjectFlags(cx, types::OBJECT_FLAG_NON_PACKED) &&
+        argTypes->hasObjectFlags(cx, types::OBJECT_FLAG_NON_PACKED))
+    {
+        return InliningStatus_NotInlined;
+    }
+
     // Constraints modeling this concat have not been generated by inference,
     // so check that type information already reflects possible side effects of
     // this call.
     types::HeapTypeSet *thisElemTypes = thisType->getProperty(cx, JSID_VOID, false);
     if (!thisElemTypes)
         return InliningStatus_Error;
 
     types::StackTypeSet *resTypes = getInlineReturnTypeSet();
--- a/js/src/methodjit/FastBuiltins.cpp
+++ b/js/src/methodjit/FastBuiltins.cpp
@@ -1012,17 +1012,21 @@ mjit::Compiler::inlineNativeFunction(uin
             thisTypes->getKnownClass() == &ArrayClass &&
             !thisTypes->hasObjectFlags(cx, types::OBJECT_FLAG_SPARSE_INDEXES |
                                        types::OBJECT_FLAG_LENGTH_OVERFLOW) &&
             argTypes->getKnownClass() == &ArrayClass &&
             !argTypes->hasObjectFlags(cx, types::OBJECT_FLAG_SPARSE_INDEXES |
                                       types::OBJECT_FLAG_LENGTH_OVERFLOW) &&
             !types::ArrayPrototypeHasIndexedProperty(cx, outerScript))
         {
-            return compileArrayConcat(thisTypes, argTypes, thisValue, arg);
+            // Don't inline if 'this' is packed and the argument may not be packed.
+            bool argPacked = !argTypes->hasObjectFlags(cx, types::OBJECT_FLAG_NON_PACKED);
+            bool thisPacked = !thisTypes->hasObjectFlags(cx, types::OBJECT_FLAG_NON_PACKED);
+            if (!(thisPacked && !argPacked))
+                return compileArrayConcat(thisTypes, argTypes, thisValue, arg);
         }
     } else if (argc == 2) {
         FrameEntry *arg1 = frame.peek(-2);
         FrameEntry *arg2 = frame.peek(-1);
 
         JSValueType arg1Type = arg1->isTypeKnown() ? arg1->getKnownType() : JSVAL_TYPE_UNKNOWN;
         JSValueType arg2Type = arg2->isTypeKnown() ? arg2->getKnownType() : JSVAL_TYPE_UNKNOWN;