Bug 1328077 - Attach dense element hole IC even with zero dense elements. r=jandem,bhackett
authorTom Schuster <evilpies@gmail.com>
Wed, 04 Jan 2017 22:12:05 +0100
changeset 375268 f897399fb28a18b34f5200677e2d585e5d4342a2
parent 375267 f67c56b193964c9d36c7a41121262a9bc66613d4
child 375269 c8883a87c6dc7c8d355fc93c9ee08bb75cfbf7db
push id1419
push userjlund@mozilla.com
push dateMon, 10 Apr 2017 20:44:07 +0000
treeherdermozilla-release@5e6801b73ef6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, bhackett
bugs1328077
milestone53.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1328077 - Attach dense element hole IC even with zero dense elements. r=jandem,bhackett
js/src/jit/CacheIR.cpp
js/src/vm/TypeInference.cpp
--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@@ -989,26 +989,22 @@ GetPropIRGenerator::tryAttachDenseElemen
     writer.loadDenseElementResult(objId, indexId);
     writer.typeMonitorResult();
     return true;
 }
 
 static bool
 CanAttachDenseElementHole(JSObject* obj)
 {
-    // Make sure this object already has dense elements.
-    if (obj->as<NativeObject>().getDenseInitializedLength() == 0)
-        return false;
-
-    // Now we have to make sure the objects on the prototype don't
-    // have any int32 properties or that such properties can't appear
-    // without a shape change.
+    // Make sure the objects on the prototype don't have any indexed properties
+    // or that such properties can't appear without a shape change.
     // Otherwise returning undefined for holes would obviously be incorrect,
     // because we would have to lookup a property on the prototype instead.
     do {
+        // The first two checks are also relevant to the receiver object.
         if (obj->isIndexed())
             return false;
 
         if (ClassCanHaveExtraProperties(obj->getClass()))
             return false;
 
         JSObject* proto = obj->staticPrototype();
         if (!proto)
@@ -1026,17 +1022,23 @@ CanAttachDenseElementHole(JSObject* obj)
 
     return true;
 }
 
 bool
 GetPropIRGenerator::tryAttachDenseElementHole(HandleObject obj, ObjOperandId objId,
                                               uint32_t index, Int32OperandId indexId)
 {
-    if (!obj->isNative() || !CanAttachDenseElementHole(obj))
+    if (!obj->isNative())
+        return false;
+
+    if (obj->as<NativeObject>().containsDenseElement(index))
+        return false;
+
+    if (!CanAttachDenseElementHole(obj))
         return false;
 
     // Guard on the shape, to prevent non-dense elements from appearing.
     writer.guardShape(objId, obj->as<NativeObject>().lastProperty());
 
     if (obj->hasUncacheableProto()) {
         // If the shape does not imply the proto, emit an explicit proto guard.
         writer.guardProto(objId, obj->staticPrototype());
--- a/js/src/vm/TypeInference.cpp
+++ b/js/src/vm/TypeInference.cpp
@@ -2529,16 +2529,17 @@ TemporaryTypeSet::propertyNeedsBarrier(C
 }
 
 bool
 js::ClassCanHaveExtraProperties(const Class* clasp)
 {
     if (clasp == &UnboxedPlainObject::class_ || clasp == &UnboxedArrayObject::class_)
         return false;
     return clasp->getResolve()
+        || clasp->getGetProperty()
         || clasp->getOpsLookupProperty()
         || clasp->getOpsGetProperty()
         || IsTypedArrayClass(clasp);
 }
 
 void
 TypeZone::processPendingRecompiles(FreeOp* fop, RecompileInfoVector& recompiles)
 {