Bug 1304955: Call site objects now store their elements as dense after bug 1283334. r=jandem a=gchang
authorEmilio Cobos Álvarez <ecoal95@gmail.com>
Thu, 20 Oct 2016 02:02:28 +0200
changeset 358473 1ec527fde116a5e705db035f379afdb45529fbb0
parent 358472 dfc5582077ae95912776b4824ec4bec5a682adbb
child 358474 74ddf7de7dc9f95eb63b140e7cb318a41584c91a
push id1324
push usermtabara@mozilla.com
push dateMon, 16 Jan 2017 13:07:44 +0000
treeherdermozilla-release@a01c49833940 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, gchang
bugs1304955, 1283334
milestone51.0a2
Bug 1304955: Call site objects now store their elements as dense after bug 1283334. r=jandem a=gchang MozReview-Commit-ID: HYvtvJLGbpT
js/src/jit-test/tests/xdr/tagged-template-literals-2.js
js/src/jit-test/tests/xdr/tagged-template-literals.js
js/src/jsobj.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/xdr/tagged-template-literals-2.js
@@ -0,0 +1,4 @@
+var code = cacheEntry("(x => x.toSource())`bar`;");
+var g = newGlobal({ cloneSingletons: true });
+assertEq("[\"bar\"]", evaluate(code, { global: g, saveBytecode: true }));
+assertEq("[\"bar\"]", evaluate(code, { global: g, loadBytecode: true }));
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/xdr/tagged-template-literals.js
@@ -0,0 +1,4 @@
+var code = cacheEntry("assertEq('bar', String.raw`bar`);");
+var g = newGlobal({ cloneSingletons: true });
+evaluate(code, { global: g, saveBytecode: true });
+evaluate(code, { global: g, loadBytecode: true })
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1162,48 +1162,25 @@ js::CloneObject(JSContext* cx, HandleObj
     return clone;
 }
 
 static bool
 GetScriptArrayObjectElements(JSContext* cx, HandleObject obj, MutableHandle<GCVector<Value>> values)
 {
     MOZ_ASSERT(!obj->isSingleton());
     MOZ_ASSERT(obj->is<ArrayObject>() || obj->is<UnboxedArrayObject>());
+    MOZ_ASSERT(!obj->isIndexed());
 
     size_t length = GetAnyBoxedOrUnboxedArrayLength(obj);
     if (!values.appendN(MagicValue(JS_ELEMENTS_HOLE), length))
         return false;
 
-    if (obj->nonProxyIsExtensible()) {
-        MOZ_ASSERT_IF(obj->is<ArrayObject>(), obj->as<ArrayObject>().slotSpan() == 0);
-
-        size_t initlen = GetAnyBoxedOrUnboxedInitializedLength(obj);
-        for (size_t i = 0; i < initlen; i++)
-            values[i].set(GetAnyBoxedOrUnboxedDenseElement(obj, i));
-    } else {
-        // Call site objects are frozen before they escape to script, which
-        // converts their dense elements into data properties.
-        ArrayObject* aobj = &obj->as<ArrayObject>();
-        for (Shape::Range<NoGC> r(aobj->lastProperty()); !r.empty(); r.popFront()) {
-            Shape& shape = r.front();
-            if (shape.propid() == NameToId(cx->names().length))
-                continue;
-            MOZ_ASSERT(shape.isDataDescriptor());
-
-            // The 'raw' property is added before freezing call site objects.
-            // After an XDR or deep clone the script object will no longer be
-            // frozen, and the two objects will be connected again the first
-            // time the JSOP_CALLSITEOBJ executes.
-            if (shape.propid() == NameToId(cx->names().raw))
-                continue;
-
-            uint32_t index = JSID_TO_INT(shape.propid());
-            values[index].set(aobj->getSlot(shape.slot()));
-        }
-    }
+    size_t initlen = GetAnyBoxedOrUnboxedInitializedLength(obj);
+    for (size_t i = 0; i < initlen; i++)
+        values[i].set(GetAnyBoxedOrUnboxedDenseElement(obj, i));
 
     return true;
 }
 
 static bool
 GetScriptPlainObjectProperties(JSContext* cx, HandleObject obj,
                                MutableHandle<IdValueVector> properties)
 {