Bug 1535031: Don't force slow path for negative indices in typed arrays r=tcampbell
authorIain Ireland <iireland@mozilla.com>
Thu, 04 Jul 2019 17:43:17 +0000
changeset 540963 9340f815a2d1fac178fae3e40f0134b9aab5e252
parent 540962 ec9171417429041d3262d4aae6f6505f2e14a6d8
child 540964 28f52fd3934ed3f724aa132253c1f25cc49ae67d
child 540995 32d7797bd8bd91e7b62ef2a5e19b8888881766f1
push id11533
push userarchaeopteryx@coole-files.de
push dateMon, 08 Jul 2019 18:18:03 +0000
treeherdermozilla-beta@f4452e031aed [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerstcampbell
bugs1535031
milestone69.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1535031: Don't force slow path for negative indices in typed arrays r=tcampbell Differential Revision: https://phabricator.services.mozilla.com/D36937
js/src/jit/IonBuilder.cpp
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -8994,27 +8994,27 @@ AbortReasonOr<Ok> IonBuilder::getElemTry
   MOZ_ASSERT(*emitted == false);
 
   Scalar::Type arrayType;
   if (!ElementAccessIsTypedArray(constraints(), obj, index, &arrayType)) {
     trackOptimizationOutcome(TrackedOutcome::AccessNotTypedArray);
     return Ok();
   }
 
-  // Don't generate a fast path if this pc has seen negative
-  // or floating-point indexes accessed which will not appear
-  // to be extra indexed properties.
+  // Don't generate a fast path if this pc has seen floating-point
+  // indexes accessed to avoid repeated bailouts. Unlike
+  // getElemTryDense, we still generate a fast path if we have seen
+  // negative indices. We expect code to occasionally generate
+  // negative indices by accident, but not to use negative indices
+  // intentionally, because typed arrays always return undefined for
+  // negative indices. See Bug 1535031.
   if (inspector->hasSeenNonIntegerIndex(pc)) {
     trackOptimizationOutcome(TrackedOutcome::ArraySeenNonIntegerIndex);
     return Ok();
   }
-  if (inspector->hasSeenNegativeIndexGetElement(pc)) {
-    trackOptimizationOutcome(TrackedOutcome::ArraySeenNegativeIndex);
-    return Ok();
-  }
 
   // Emit typed getelem variant.
   MOZ_TRY(jsop_getelem_typed(obj, index, arrayType));
 
   trackOptimizationSuccess();
   *emitted = true;
   return Ok();
 }