Bug 557713 - encapsulate JSSLOT_ARGS_* within JSObject. r=brendan.
authorNicholas Nethercote <nnethercote@mozilla.com>
Sun, 11 Apr 2010 16:45:20 -0700
changeset 40864 a39e0ce1c8ca25adbdd40fbbaf075db003a49751
parent 40862 91ca703f8d6947d5d84042d9cb145867bd4f7e8a
child 40865 2648a73e1e43f4db50a2cd06ad9867cd1fe8a28a
push id1
push userroot
push dateTue, 26 Apr 2011 22:38:44 +0000
treeherdermozilla-beta@bfdb6e623a36 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbrendan
bugs557713
milestone1.9.3a5pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
Bug 557713 - encapsulate JSSLOT_ARGS_* within JSObject. r=brendan.
js/src/jsarray.cpp
js/src/jsfun.cpp
js/src/jsfun.h
js/src/jsobj.h
js/src/jsobjinlines.h
js/src/jsops.cpp
js/src/jstracer.cpp
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -226,18 +226,18 @@ ValueIsLength(JSContext *cx, jsval* vp)
 JSBool
 js_GetLengthProperty(JSContext *cx, JSObject *obj, jsuint *lengthp)
 {
     if (obj->isArray()) {
         *lengthp = obj->getArrayLength();
         return true;
     }
 
-    if (obj->isArguments() && !IsOverriddenArgsLength(obj)) {
-        *lengthp = GetArgsLength(obj);
+    if (obj->isArguments() && !obj->isArgsLengthOverridden()) {
+        *lengthp = obj->getArgsLength();
         return true;
     }
 
     AutoValueRooter tvr(cx, JSVAL_NULL);
     if (!obj->getProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.lengthAtom), tvr.addr()))
         return false;
 
     if (JSVAL_IS_INT(tvr.value())) {
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -80,37 +80,16 @@
 #endif
 
 #include "jsatominlines.h"
 #include "jsobjinlines.h"
 
 using namespace js;
 
 static inline void
-SetOverriddenArgsLength(JSObject *obj)
-{
-    JS_ASSERT(obj->isArguments());
-
-    jsval v = obj->fslots[JSSLOT_ARGS_LENGTH];
-    v = INT_TO_JSVAL(JSVAL_TO_INT(v) | 1);
-    JS_ASSERT(JSVAL_IS_INT(v));
-    obj->fslots[JSSLOT_ARGS_LENGTH] = v;
-}
-
-static inline void
-InitArgsLengthSlot(JSObject *obj, uint32 argc)
-{
-    JS_ASSERT(obj->isArguments());
-    JS_ASSERT(argc <= JS_ARGS_LENGTH_MAX);
-    JS_ASSERT(obj->fslots[JSSLOT_ARGS_LENGTH] == JSVAL_VOID);
-    obj->fslots[JSSLOT_ARGS_LENGTH] = INT_TO_JSVAL(argc << 1);
-    JS_ASSERT(!IsOverriddenArgsLength(obj));
-}
-
-static inline void
 SetArgsPrivateNative(JSObject *argsobj, ArgsPrivateNative *apn)
 {
     JS_ASSERT(argsobj->isArguments());
     uintptr_t p = (uintptr_t) apn;
     argsobj->setPrivate((void*) (p | 2));
 }
 
 JSBool
@@ -176,17 +155,17 @@ js_GetArgsProperty(JSContext *cx, JSStac
              * is null at this point, as it would be in the example, return
              * undefined in *vp.
              */
             if (argsobj)
                 return argsobj->getProperty(cx, id, vp);
         }
     } else if (id == ATOM_TO_JSID(cx->runtime->atomState.lengthAtom)) {
         JSObject *argsobj = JSVAL_TO_OBJECT(fp->argsobj);
-        if (argsobj && IsOverriddenArgsLength(argsobj))
+        if (argsobj && argsobj->isArgsLengthOverridden())
             return argsobj->getProperty(cx, id, vp);
         *vp = INT_TO_JSVAL(jsint(fp->argc));
     }
     return true;
 }
 
 static JSObject *
 NewArguments(JSContext *cx, JSObject *parent, uint32 argc, JSObject *callee)
@@ -196,32 +175,32 @@ NewArguments(JSContext *cx, JSObject *pa
         return NULL;
 
     JSObject *argsobj = js_NewGCObject(cx);
     if (!argsobj)
         return NULL;
 
     /* Init immediately to avoid GC seeing a half-init'ed object. */
     argsobj->init(&js_ArgumentsClass, proto, parent, JSVAL_NULL);
-    argsobj->fslots[JSSLOT_ARGS_CALLEE] = OBJECT_TO_JSVAL(callee);
-    InitArgsLengthSlot(argsobj, argc);
+    argsobj->setArgsCallee(OBJECT_TO_JSVAL(callee));
+    argsobj->setArgsLength(argc);
 
     argsobj->map = cx->runtime->emptyArgumentsScope;
     cx->runtime->emptyArgumentsScope->hold();
 
     /* This must come after argsobj->map has been set. */
     if (!js_EnsureReservedSlots(cx, argsobj, argc))
         return NULL;
     return argsobj;
 }
 
 static void
 PutArguments(JSContext *cx, JSObject *argsobj, jsval *args)
 {
-    uint32 argc = GetArgsLength(argsobj);
+    uint32 argc = argsobj->getArgsLength();
     for (uint32 i = 0; i != argc; ++i) {
         jsval v = argsobj->dslots[i];
         if (v != JSVAL_HOLE)
             argsobj->dslots[i] = args[i];
     }
 }
 
 JSObject *
@@ -316,22 +295,22 @@ JS_DEFINE_CALLINFO_3(extern, BOOL, js_Pu
 
 static JSBool
 args_delProperty(JSContext *cx, JSObject *obj, jsval idval, jsval *vp)
 {
     JS_ASSERT(obj->isArguments());
 
     if (JSVAL_IS_INT(idval)) {
         uintN arg = uintN(JSVAL_TO_INT(idval));
-        if (arg < GetArgsLength(obj))
+        if (arg < obj->getArgsLength())
             SetArgsSlot(obj, arg, JSVAL_HOLE);
     } else if (idval == ATOM_KEY(cx->runtime->atomState.lengthAtom)) {
-        SetOverriddenArgsLength(obj);
+        obj->setArgsLengthOverridden();
     } else if (idval == ATOM_KEY(cx->runtime->atomState.calleeAtom)) {
-        obj->fslots[JSSLOT_ARGS_CALLEE] = JSVAL_HOLE;
+        obj->setArgsCallee(JSVAL_HOLE);
     }
     return true;
 }
 
 static JS_REQUIRES_STACK JSObject *
 WrapEscapingClosure(JSContext *cx, JSStackFrame *fp, JSObject *funobj, JSFunction *fun)
 {
     JS_ASSERT(GET_FUNCTION_PRIVATE(cx, funobj) == fun);
@@ -509,17 +488,17 @@ ArgGetter(JSContext *cx, JSObject *obj, 
         return true;
 
     if (JSVAL_IS_INT(idval)) {
         /*
          * arg can exceed the number of arguments if a script changed the
          * prototype to point to another Arguments object with a bigger argc.
          */
         uintN arg = uintN(JSVAL_TO_INT(idval));
-        if (arg < GetArgsLength(obj)) {
+        if (arg < obj->getArgsLength()) {
 #ifdef JS_TRACER
             ArgsPrivateNative *argp = GetArgsPrivateNative(obj);
             if (argp) {
                 if (NativeToValue(cx, *vp, argp->typemap()[arg], &argp->argv[arg]))
                     return true;
                 LeaveTrace(cx);
                 return false;
             }
@@ -530,21 +509,21 @@ ArgGetter(JSContext *cx, JSObject *obj, 
                 *vp = fp->argv[arg];
             } else {
                 jsval v = GetArgsSlot(obj, arg);
                 if (v != JSVAL_HOLE)
                     *vp = v;
             }
         }
     } else if (idval == ATOM_KEY(cx->runtime->atomState.lengthAtom)) {
-        if (!IsOverriddenArgsLength(obj))
-            *vp = INT_TO_JSVAL(GetArgsLength(obj));
+        if (!obj->isArgsLengthOverridden())
+            *vp = INT_TO_JSVAL(obj->getArgsLength());
     } else {
         JS_ASSERT(idval == ATOM_KEY(cx->runtime->atomState.calleeAtom));
-        jsval v = obj->fslots[JSSLOT_ARGS_CALLEE];
+        jsval v = obj->getArgsCallee();
         if (v != JSVAL_HOLE) {
             /*
              * If this function or one in it needs upvars that reach above it
              * in the scope chain, it must not be a null closure (it could be a
              * flat closure, or an unoptimized closure -- the latter itself not
              * necessarily heavyweight). Rather than wrap here, we simply throw
              * to reduce code size and tell debugger users the truth instead of
              * passing off a fibbing wrapper.
@@ -574,17 +553,17 @@ ArgSetter(JSContext *cx, JSObject *obj, 
     }
 #endif
 
     if (!JS_InstanceOf(cx, obj, &js_ArgumentsClass, NULL))
         return true;
 
     if (JSVAL_IS_INT(idval)) {
         uintN arg = uintN(JSVAL_TO_INT(idval));
-        if (arg < GetArgsLength(obj)) {
+        if (arg < obj->getArgsLength()) {
             JSStackFrame *fp = (JSStackFrame *) obj->getPrivate();
             if (fp) {
                 fp->argv[arg] = *vp;
                 return true;
             }
         }
     } else {
         JS_ASSERT(idval == ATOM_KEY(cx->runtime->atomState.lengthAtom) ||
@@ -611,23 +590,23 @@ args_resolve(JSContext *cx, JSObject *ob
              JSObject **objp)
 {
     JS_ASSERT(obj->isArguments());
 
     *objp = NULL;
     jsid id = 0;
     if (JSVAL_IS_INT(idval)) {
         uint32 arg = uint32(JSVAL_TO_INT(idval));
-        if (arg < GetArgsLength(obj) && GetArgsSlot(obj, arg) != JSVAL_HOLE)
+        if (arg < obj->getArgsLength() && GetArgsSlot(obj, arg) != JSVAL_HOLE)
             id = INT_JSVAL_TO_JSID(idval);
     } else if (idval == ATOM_KEY(cx->runtime->atomState.lengthAtom)) {
-        if (!IsOverriddenArgsLength(obj))
+        if (!obj->isArgsLengthOverridden())
             id = ATOM_TO_JSID(cx->runtime->atomState.lengthAtom);
     } else if (idval == ATOM_KEY(cx->runtime->atomState.calleeAtom)) {
-        if (obj->fslots[JSSLOT_ARGS_CALLEE] != JSVAL_HOLE)
+        if (obj->getArgsCallee() != JSVAL_HOLE)
             id = ATOM_TO_JSID(cx->runtime->atomState.calleeAtom);
     }
 
     if (id != 0) {
         /*
          * XXX ECMA specs DontEnum even for indexed properties, contrary to
          * other array-like objects.
          */
@@ -642,17 +621,17 @@ static JSBool
 args_enumerate(JSContext *cx, JSObject *obj)
 {
     JS_ASSERT(obj->isArguments());
 
     /*
      * Trigger reflection in args_resolve using a series of js_LookupProperty
      * calls.
      */
-    int argc = int(GetArgsLength(obj));
+    int argc = int(obj->getArgsLength());
     for (int i = -2; i != argc; i++) {
         jsid id = (i == -2)
                   ? ATOM_TO_JSID(cx->runtime->atomState.lengthAtom)
                   : (i == -1)
                   ? ATOM_TO_JSID(cx->runtime->atomState.calleeAtom)
                   : INT_JSVAL_TO_JSID(INT_TO_JSVAL(i));
 
         JSObject *pobj;
@@ -690,35 +669,34 @@ args_or_call_trace(JSTracer *trc, JSObje
 }
 #else
 # define args_or_call_trace NULL
 #endif
 
 static uint32
 args_reserveSlots(JSContext *cx, JSObject *obj)
 {
-    JS_ASSERT(obj->isArguments());
-    return GetArgsLength(obj);
+    return obj->getArgsLength();
 }
 
 /*
  * The Arguments class is not initialized via JS_InitClass, and must not be,
  * because its name is "Object".  Per ECMA, that causes instances of it to
  * delegate to the object named by Object.prototype.  It also ensures that
  * arguments.toString() returns "[object Object]".
  *
  * The JSClass functions below collaborate to lazily reflect and synchronize
  * actual argument values, argument count, and callee function object stored
  * in a JSStackFrame with their corresponding property values in the frame's
  * arguments object.
  */
 JSClass js_ArgumentsClass = {
     js_Object_str,
     JSCLASS_HAS_PRIVATE | JSCLASS_NEW_RESOLVE |
-    JSCLASS_HAS_RESERVED_SLOTS(ARGS_FIXED_RESERVED_SLOTS) |
+    JSCLASS_HAS_RESERVED_SLOTS(JSObject::ARGS_FIXED_RESERVED_SLOTS) |
     JSCLASS_MARK_IS_TRACE | JSCLASS_HAS_CACHED_PROTO(JSProto_Object),
     JS_PropertyStub,    args_delProperty,
     JS_PropertyStub,    JS_PropertyStub,
     args_enumerate,     (JSResolveOp) args_resolve,
     JS_ConvertStub,     NULL,
     NULL,               NULL,
     NULL,               NULL,
     NULL,               NULL,
@@ -2092,17 +2070,17 @@ js_fun_apply(JSContext *cx, uintN argc, 
     invokevp = js_AllocStack(cx, 2 + argc, &mark);
     if (!invokevp)
         return JS_FALSE;
 
     /* Push fval, obj, and aobj's elements as args. */
     sp = invokevp;
     *sp++ = fval;
     *sp++ = OBJECT_TO_JSVAL(obj);
-    if (aobj && aobj->isArguments() && !IsOverriddenArgsLength(aobj)) {
+    if (aobj && aobj->isArguments() && !aobj->isArgsLengthOverridden()) {
         /*
          * Two cases, two loops: note how in the case of an active stack frame
          * backing aobj, even though we copy from fp->argv, we still must check
          * aobj->dslots[i] for a hole, to handle a delete on the corresponding
          * arguments element. See args_delProperty.
          */
         JSStackFrame *fp = (JSStackFrame *) aobj->getPrivate();
         if (fp) {
--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@@ -409,41 +409,16 @@ js_GetArgsObject(JSContext *cx, JSStackF
 
 extern void
 js_PutArgsObject(JSContext *cx, JSStackFrame *fp);
 
 inline bool
 js_IsNamedLambda(JSFunction *fun) { return (fun->flags & JSFUN_LAMBDA) && fun->atom; }
 
 /*
- * Reserved slot structure for Arguments objects:
- *
- * JSSLOT_PRIVATE       - the corresponding frame until the frame exits.
- * JSSLOT_ARGS_LENGTH   - the number of actual arguments and a flag indicating
- *                        whether arguments.length was overwritten.
- * JSSLOT_ARGS_CALLEE   - the arguments.callee value or JSVAL_HOLE if that was
- *                        overwritten.
- * JSSLOT_ARGS_START    - room to store the corresponding arguments after the
- *                        frame exists. The slot's value will be JSVAL_HOLE if
- *                        arguments[i] was deleted or overwritten.
- *
- * The static assertion checks that hand-optimized code can fetch and store the
- * argument value at argsobj->dslots[i] for argument index i. But future-proof
- * your code by using {Get,Set}ArgsSlot instead of naked dslots references.
- */
-const uint32 JSSLOT_ARGS_LENGTH = JSSLOT_PRIVATE + 1;
-const uint32 JSSLOT_ARGS_CALLEE = JSSLOT_PRIVATE + 2;
-const uint32 JSSLOT_ARGS_START  = JSSLOT_PRIVATE + 3;
-
-JS_STATIC_ASSERT(JSSLOT_ARGS_START == JS_INITIAL_NSLOTS);
-
-/* Number of extra fixed slots besides JSSLOT_PRIVATE. */
-const uint32 ARGS_FIXED_RESERVED_SLOTS = JSSLOT_ARGS_START - JSSLOT_ARGS_LENGTH;
-
-/*
  * Maximum supported value of arguments.length. It bounds the maximum number of
  * arguments that can be supplied via the second (so-called |argArray|) param
  * to Function.prototype.apply. This value also bounds the number of elements
  * parsed in an array initialiser.
  */
 const uint32 JS_ARGS_LENGTH_MAX = JS_BIT(24) - 1;
 
 /*
@@ -463,35 +438,16 @@ GetArgsSlot(JSObject *argsobj, uint32 ar
 }
 
 inline void
 SetArgsSlot(JSObject *argsobj, uint32 arg, jsval v)
 {
     argsobj->dslots[arg] = v;
 }
 
-inline bool
-IsOverriddenArgsLength(JSObject *obj)
-{
-    JS_ASSERT(obj->isArguments());
-
-    jsval v = obj->fslots[JSSLOT_ARGS_LENGTH];
-    return (JSVAL_TO_INT(v) & 1) != 0;
-}
-
-inline uint32
-GetArgsLength(JSObject *obj)
-{
-    JS_ASSERT(obj->isArguments());
-
-    uint32 argc = uint32(JSVAL_TO_INT(obj->fslots[JSSLOT_ARGS_LENGTH])) >> 1;
-    JS_ASSERT(argc <= JS_ARGS_LENGTH_MAX);
-    return argc;
-}
-
 } /* namespace js */
 
 extern JSBool
 js_XDRFunctionObject(JSXDRState *xdr, JSObject **objp);
 
 typedef enum JSLocalKind {
     JSLOCAL_NONE,
     JSLOCAL_ARG,
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -401,26 +401,60 @@ struct JSObject {
 
     // This assertion must remain true;  see comment in js_MakeArraySlow().
     // (Nb: This method is never called, it just contains a static assertion.
     // The static assertion isn't inline because that doesn't work on Mac.)
     inline void staticAssertArrayLengthIsInPrivateSlot();
 
   public:
     inline uint32 getArrayLength() const;
-    inline uint32 getArrayCount() const;
+    inline void setArrayLength(uint32 length);
 
-    inline void setArrayLength(uint32 length);
+    inline uint32 getArrayCount() const;
+    inline void voidDenseArrayCount();
     inline void setArrayCount(uint32 count);
-    inline void voidDenseArrayCount();
     inline void incArrayCountBy(uint32 posDelta);
     inline void decArrayCountBy(uint32 negDelta);
+
     inline void voidArrayUnused();
 
     /*
+     * Arguments-specific getters and setters.
+     */
+
+    /*
+     * Reserved slot structure for Arguments objects:
+     *
+     * JSSLOT_PRIVATE       - the corresponding frame until the frame exits.
+     * JSSLOT_ARGS_LENGTH   - the number of actual arguments and a flag
+     *                        indicating whether arguments.length was
+     *                        overwritten.
+     * JSSLOT_ARGS_CALLEE   - the arguments.callee value or JSVAL_HOLE if that
+     *                        was overwritten.
+     *
+     * Argument index i is stored in dslots[i].  But future-proof your code by
+     * using {Get,Set}ArgsSlot instead of naked dslots references.
+     */
+  private:
+    static const uint32 JSSLOT_ARGS_LENGTH = JSSLOT_PRIVATE + 1;
+    static const uint32 JSSLOT_ARGS_CALLEE = JSSLOT_PRIVATE + 2;
+
+  public:
+    /* Number of extra fixed slots besides JSSLOT_PRIVATE. */
+    static const uint32 ARGS_FIXED_RESERVED_SLOTS = 2;
+
+    inline uint32 getArgsLength() const;
+    inline void setArgsLength(uint32 argc);
+    inline void setArgsLengthOverridden();
+    inline bool isArgsLengthOverridden();
+
+    inline jsval getArgsCallee() const;
+    inline void setArgsCallee(jsval callee);
+
+    /*
      * Back to generic stuff.
      */
 
     bool isCallable();
 
     /* The map field is not initialized here and should be set separately. */
     void init(JSClass *clasp, JSObject *proto, JSObject *parent,
               jsval privateSlotValue) {
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -141,16 +141,66 @@ JSObject::decArrayCountBy(uint32 negDelt
 inline void
 JSObject::voidArrayUnused()
 {
     JS_ASSERT(isArray());
     fslots[JSSLOT_ARRAY_COUNT] = JSVAL_VOID;
 }
 
 inline void
+JSObject::setArgsLength(uint32 argc)
+{
+    JS_ASSERT(isArguments());
+    JS_ASSERT(argc <= JS_ARGS_LENGTH_MAX);
+    fslots[JSSLOT_ARGS_LENGTH] = INT_TO_JSVAL(argc << 1);
+    JS_ASSERT(!isArgsLengthOverridden());
+}
+
+inline uint32
+JSObject::getArgsLength() const
+{
+    JS_ASSERT(isArguments());
+    uint32 argc = uint32(JSVAL_TO_INT(fslots[JSSLOT_ARGS_LENGTH])) >> 1;
+    JS_ASSERT(argc <= JS_ARGS_LENGTH_MAX);
+    return argc;
+}
+
+inline void
+JSObject::setArgsLengthOverridden()
+{
+    JS_ASSERT(isArguments());
+    jsval v = fslots[JSSLOT_ARGS_LENGTH];
+    v = INT_TO_JSVAL(JSVAL_TO_INT(v) | 1);
+    JS_ASSERT(JSVAL_IS_INT(v));
+    fslots[JSSLOT_ARGS_LENGTH] = v;
+}
+
+inline bool
+JSObject::isArgsLengthOverridden()
+{
+    JS_ASSERT(isArguments());
+    jsval v = fslots[JSSLOT_ARGS_LENGTH];
+    return (JSVAL_TO_INT(v) & 1) != 0;
+}
+
+inline jsval 
+JSObject::getArgsCallee() const
+{
+    JS_ASSERT(isArguments());
+    return fslots[JSSLOT_ARGS_CALLEE];
+}
+
+inline void 
+JSObject::setArgsCallee(jsval callee)
+{
+    JS_ASSERT(isArguments());
+    fslots[JSSLOT_ARGS_CALLEE] = callee;
+}
+
+inline void
 JSObject::initSharingEmptyScope(JSClass *clasp, JSObject *proto, JSObject *parent,
                                 jsval privateSlotValue)
 {
     init(clasp, proto, parent, privateSlotValue);
 
     JSEmptyScope *emptyScope = proto->scope()->emptyScope;
     JS_ASSERT(emptyScope->clasp == clasp);
     emptyScope->hold();
--- a/js/src/jsops.cpp
+++ b/js/src/jsops.cpp
@@ -1510,18 +1510,18 @@ BEGIN_CASE(JSOP_LENGTH)
         obj = JSVAL_TO_OBJECT(lval);
         if (obj->isArray()) {
             jsuint length = obj->getArrayLength();
 
             if (length <= JSVAL_INT_MAX)
                 regs.sp[-1] = INT_TO_JSVAL(length);
             else if (!js_NewDoubleInRootedValue(cx, (jsdouble) length, &regs.sp[-1]))
                 goto error;
-        } else if (obj->isArguments() && !IsOverriddenArgsLength(obj)) {
-            uint32 length = GetArgsLength(obj);
+        } else if (obj->isArguments() && !obj->isArgsLengthOverridden()) {
+            uint32 length = obj->getArgsLength();
 
             JS_ASSERT(INT_FITS_IN_JSVAL(length));
             regs.sp[-1] = INT_TO_JSVAL(length);
         } else {
             i = -2;
             goto do_getprop_with_lval;
         }
     } else {
@@ -1868,17 +1868,17 @@ BEGIN_CASE(JSOP_GETELEM)
             }
         } else if (obj->isArguments()
 #ifdef JS_TRACER
                    && !GetArgsPrivateNative(obj)
 #endif
                   ) {
             uint32 arg = uint32(JSVAL_TO_INT(rval));
 
-            if (arg < GetArgsLength(obj)) {
+            if (arg < obj->getArgsLength()) {
                 JSStackFrame *afp = (JSStackFrame *) obj->getPrivate();
                 if (afp) {
                     rval = afp->argv[arg];
                     goto end_getelem;
                 }
 
                 rval = GetArgsSlot(obj, arg);
                 if (rval != JSVAL_HOLE)
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -14100,17 +14100,17 @@ TraceRecorder::record_JSOP_ARGSUB()
     RETURN_STOP_A("can't trace JSOP_ARGSUB hard case");
 }
 
 JS_REQUIRES_STACK LIns*
 TraceRecorder::guardArgsLengthNotAssigned(LIns* argsobj_ins)
 {
     // The following implements IsOverriddenArgsLength on trace.
     // The '2' bit is set if length was overridden.
-    LIns *len_ins = stobj_get_fslot(argsobj_ins, JSSLOT_ARGS_LENGTH);
+    LIns *len_ins = stobj_get_fslot(argsobj_ins, JSObject::JSSLOT_ARGS_LENGTH);
     LIns *ovr_ins = lir->ins2(LIR_piand, len_ins, INS_CONSTWORD(2));
     guard(true, lir->ins_peq0(ovr_ins), snapshot(BRANCH_EXIT));
     return len_ins;
 }
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_ARGCNT()
 {
@@ -14118,17 +14118,17 @@ TraceRecorder::record_JSOP_ARGCNT()
         RETURN_STOP_A("can't trace heavyweight JSOP_ARGCNT");
 
     // argc is fixed on trace, so ideally we would simply generate LIR for
     // constant argc. But the user can mutate arguments.length in the
     // interpreter, so we have to check for that in the trace entry frame.
     // We also have to check that arguments.length has not been mutated
     // at record time, because if so we will generate incorrect constant
     // LIR, which will assert in alu().
-    if (cx->fp->argsobj && IsOverriddenArgsLength(JSVAL_TO_OBJECT(cx->fp->argsobj)))
+    if (cx->fp->argsobj && JSVAL_TO_OBJECT(cx->fp->argsobj)->isArgsLengthOverridden())
         RETURN_STOP_A("can't trace JSOP_ARGCNT if arguments.length has been modified");
     LIns *a_ins = get(&cx->fp->argsobj);
     if (callDepth == 0) {
         LIns *br = lir->insBranch(LIR_jt, lir->ins_peq0(a_ins), NULL);
         guardArgsLengthNotAssigned(a_ins);
         LIns *label = lir->ins0(LIR_label);
         br->setTarget(label);
     }
@@ -14999,17 +14999,17 @@ TraceRecorder::record_JSOP_LENGTH()
     if (obj->isArguments()) {
         unsigned depth;
         JSStackFrame *afp = guardArguments(obj, obj_ins, &depth);
         if (!afp)
             RETURN_STOP_A("can't reach arguments object's frame");
 
         // We must both check at record time and guard at run time that
         // arguments.length has not been reassigned, redefined or deleted.
-        if (IsOverriddenArgsLength(obj))
+        if (obj->isArgsLengthOverridden())
             RETURN_STOP_A("can't trace JSOP_ARGCNT if arguments.length has been modified");
         LIns* slot_ins = guardArgsLengthNotAssigned(obj_ins);
 
         // slot_ins is the value from the slot; right-shift by 2 bits to get
         // the length (see GetArgsLength in jsfun.cpp).
         LIns* v_ins = lir->ins1(LIR_i2f, lir->ins2i(LIR_rsh, p2i(slot_ins), 2));
         set(&l, v_ins);
         return ARECORD_CONTINUE;