Bug 799818 part 1 - Ensure return type before optimizing getelem for strings. r=jandem
authorNicolas B. Pierron <nicolas.b.pierron@mozilla.com>
Fri, 19 Oct 2012 16:45:16 -0700
changeset 110964 47b425f4f50c3b3447bd2eb034f8f5158fa37cdf
parent 110963 eeaec0df48ee980504a7d3911dac7f457d45136c
child 110965 e70b2e6a920777160858b9d105a89949af221a1f
push id93
push usernmatsakis@mozilla.com
push dateWed, 31 Oct 2012 21:26:57 +0000
reviewersjandem
bugs799818
milestone19.0a1
Bug 799818 part 1 - Ensure return type before optimizing getelem for strings. r=jandem
js/src/ion/IonBuilder.cpp
js/src/ion/TypeOracle.cpp
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -5049,16 +5049,19 @@ IonBuilder::jsop_getelem_string()
 
     MInstruction *idInt32 = MToInt32::New(id);
     current->add(idInt32);
     id = idInt32;
 
     MStringLength *length = MStringLength::New(str);
     current->add(length);
 
+    // This will cause an invalidation of this script once the 'undefined' type
+    // is monitored by the interpreter.
+    JS_ASSERT(oracle->propertyRead(script_, pc)->getKnownTypeTag() == JSVAL_TYPE_STRING);
     id = addBoundsCheck(id, length);
 
     MCharCodeAt *charCode = MCharCodeAt::New(str, id);
     current->add(charCode);
 
     MFromCharCode *result = MFromCharCode::New(charCode);
     current->add(result);
     current->push(result);
--- a/js/src/ion/TypeOracle.cpp
+++ b/js/src/ion/TypeOracle.cpp
@@ -352,18 +352,21 @@ TypeInferenceOracle::elementReadIsString
     StackTypeSet *id = script->analysis()->poppedTypes(pc, 0);
 
     if (value->getKnownTypeTag() != JSVAL_TYPE_STRING)
         return false;
 
     if (id->getKnownTypeTag() != JSVAL_TYPE_INT32)
         return false;
 
-    types::TypeSet *pushed = script->analysis()->pushedTypes(pc, 0);
-    if (!pushed->hasType(types::Type::StringType()))
+    // This function is used for jsop_getelem_string which should return
+    // undefined if this is out-side the string bounds. Currently we just
+    // fallback to a CallGetElement.
+    StackTypeSet *pushed = script->analysis()->pushedTypes(pc, 0);
+    if (pushed->getKnownTypeTag() != JSVAL_TYPE_STRING)
         return false;
 
     return true;
 }
 
 bool
 TypeInferenceOracle::elementReadIsPacked(JSScript *script, jsbytecode *pc)
 {