Merge.
authorAndreas Gal <gal@mozilla.com>
Sat, 05 Jul 2008 19:18:14 -0700
changeset 17443 f4c96a566c4c826d41a6249d784b90e465c66cff
parent 17442 138fc2d7f4fe744306e5244549030edfb3d9469c (current diff)
parent 17441 1a4d440c60e4d2dbc9fd3c6c50ab7c9dc6e0b0b7 (diff)
child 17444 355d79be4adfe120ebcb0ee2f61ee463106f10e5
push id1
push userroot
push dateTue, 26 Apr 2011 22:38:44 +0000
treeherdermozilla-beta@bfdb6e623a36 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone1.9.1a1pre
Merge.
js/src/jstracer.cpp
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -1237,21 +1237,22 @@ bool TraceRecorder::JSOP_SETELEM()
     /* check that the index is within bounds */
     jsint idx = asInt(r);
     LIns* idx_ins = get(&r);
     if (!guardDenseArrayIndexWithinBounds(obj, idx, obj_ins, dslots_ins, idx_ins))
         return false;
     /* get us the address of the array slot */
     LIns* addr = lir->ins2(LIR_add, dslots_ins, 
             lir->ins2i(LIR_lsh, idx_ins, sizeof(jsval) == 4 ? 2 : 3));
-    /* if the current value is a hole, abort */
-    if (obj->dslots[idx] == JSVAL_HOLE)
-        return false;
     LIns* oldval = lir->insLoad(LIR_ld, addr, 0);
-    guard(false, lir->ins2(LIR_eq, oldval, lir->insImmPtr((void*)JSVAL_HOLE)));
+    LIns* isHole = lir->ins2(LIR_eq, oldval, lir->insImmPtr((void*)JSVAL_HOLE));
+    LIns* count = lir->insLoadi(obj_ins,
+                                offsetof(JSObject, fslots[JSSLOT_ARRAY_COUNT]));
+    lir->insStorei(lir->ins2(LIR_add, count, isHole), obj_ins,
+                   offsetof(JSObject, fslots[JSSLOT_ARRAY_COUNT]));
     /* ok, box the value we are storing, store it and we are done */
     LIns* v_ins = get(&v);
     if (isInt(v))
         lir->insStorei(int32_to_jsval(v_ins), addr, 0);
     else if (isDouble(v))
         lir->insStorei(double_to_jsval(v_ins), addr, 0);
     else
         return false; /* don't know how to box this type */