Bug 1500267 - Correct out of date comments r=tcampbell
authorMatthew Gaudet <mgaudet@mozilla.com>
Fri, 19 Oct 2018 15:41:59 +0000
changeset 490524 cb06428d3b23a3943d08086cfd427387ea400bb3
parent 490523 59d216896c04522d674c86e16ce59658973dfab4
child 490525 ca071890a9a0d926df0c6c8840b9e9caefeaad83
push id247
push userfmarier@mozilla.com
push dateSat, 27 Oct 2018 01:06:44 +0000
reviewerstcampbell
bugs1500267
milestone64.0a1
Bug 1500267 - Correct out of date comments r=tcampbell Depends on D9164 Differential Revision: https://phabricator.services.mozilla.com/D9165
js/src/jit/CacheIR.cpp
--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@@ -4017,18 +4017,19 @@ SetPropIRGenerator::tryAttachSetDenseEle
     }
 
     MOZ_ASSERT(!nobj->getElementsHeader()->isFrozen(),
                "Extensible objects should not have frozen elements");
 
     uint32_t initLength = nobj->getDenseInitializedLength();
 
     // Optimize if we're adding an element at initLength or writing to a hole.
-    // Don't handle the adding case if the current accesss is in bounds, to
-    // ensure we always call noteArrayWriteHole.
+    //
+    // In the case where index > initLength, we need noteHasDenseAdd to be called
+    // to ensure Ion is aware that writes have occurred to-out-of-bound indexes before.
     bool isAdd = index == initLength;
     bool isHoleInBounds = index < initLength && !nobj->containsDenseElement(index);
     if (!isAdd && !isHoleInBounds) {
         return false;
     }
 
     // Can't add new elements to arrays with non-writable length.
     if (isAdd && nobj->is<ArrayObject>() && !nobj->as<ArrayObject>().lengthIsWritable()) {