From 6c7a5905f5573f366bd8360b46b5a62711b8576a Mon Sep 17 00:00:00 2001 From: Jan de Mooij Date: Wed, 28 Dec 2011 20:44:27 +0100 Subject: [PATCH] Bug 713867 - Move arrayPrototypeHasIndexedProperty from JM to jsinfer. r=bhackett --- js/src/jsinfer.cpp | 23 +++++++++++++++++++++++ js/src/jsinfer.h | 7 +++++++ js/src/methodjit/Compiler.cpp | 23 ----------------------- js/src/methodjit/Compiler.h | 2 -- js/src/methodjit/FastBuiltins.cpp | 4 ++-- js/src/methodjit/FastOps.cpp | 4 ++-- js/src/methodjit/LoopState.cpp | 2 +- 7 files changed, 35 insertions(+), 30 deletions(-) diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp index 63ec1d82783d..083bc6530ced 100644 --- a/js/src/jsinfer.cpp +++ b/js/src/jsinfer.cpp @@ -2085,6 +2085,29 @@ types::UseNewType(JSContext *cx, JSScript *script, jsbytecode *pc) return false; } +bool +types::ArrayPrototypeHasIndexedProperty(JSContext *cx, JSScript *script) +{ + if (!cx->typeInferenceEnabled() || !script->hasGlobal()) + return true; + + JSObject *proto; + if (!js_GetClassPrototype(cx, NULL, JSProto_Array, &proto, NULL)) + return true; + + while (proto) { + TypeObject *type = proto->getType(cx); + if (type->unknownProperties()) + return true; + TypeSet *indexTypes = type->getProperty(cx, JSID_VOID, false); + if (!indexTypes || indexTypes->isOwnProperty(cx, type, true) || indexTypes->knownNonEmpty(cx)) + return true; + proto = proto->getProto(); + } + + return false; +} + bool TypeCompartment::growPendingArray(JSContext *cx) { diff --git a/js/src/jsinfer.h b/js/src/jsinfer.h index 74a6beb396a3..d03e04e46256 100644 --- a/js/src/jsinfer.h +++ b/js/src/jsinfer.h @@ -911,6 +911,13 @@ MarkArgumentsCreated(JSContext *cx, JSScript *script); bool UseNewType(JSContext *cx, JSScript *script, jsbytecode *pc); +/* + * Whether Array.prototype, or an object on its proto chain, has an + * indexed property. + */ +bool +ArrayPrototypeHasIndexedProperty(JSContext *cx, JSScript *script); + /* * Type information about a callsite. this is separated from the bytecode * information itself so we can handle higher order functions not called diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp index 01555b690f01..63e04a6f30c1 100644 --- a/js/src/methodjit/Compiler.cpp +++ b/js/src/methodjit/Compiler.cpp @@ -7610,29 +7610,6 @@ mjit::Compiler::pushedSingleton(unsigned pushed) return types->getSingleton(cx); } -bool -mjit::Compiler::arrayPrototypeHasIndexedProperty() -{ - if (!cx->typeInferenceEnabled() || !globalObj) - return true; - - JSObject *proto; - if (!js_GetClassPrototype(cx, NULL, JSProto_Array, &proto, NULL)) - return true; - - while (proto) { - types::TypeObject *type = proto->getType(cx); - if (type->unknownProperties()) - return true; - types::TypeSet *indexTypes = type->getProperty(cx, JSID_VOID, false); - if (!indexTypes || indexTypes->isOwnProperty(cx, type, true) || indexTypes->knownNonEmpty(cx)) - return true; - proto = proto->getProto(); - } - - return false; -} - /* * Barriers overview. * diff --git a/js/src/methodjit/Compiler.h b/js/src/methodjit/Compiler.h index ad27366c3b9a..889235c2fa90 100644 --- a/js/src/methodjit/Compiler.h +++ b/js/src/methodjit/Compiler.h @@ -486,8 +486,6 @@ private: return callSites[index].inlinepc; } - bool arrayPrototypeHasIndexedProperty(); - bool activeFrameHasMultipleExits() { ActiveFrame *na = a; while (na->parent) { diff --git a/js/src/methodjit/FastBuiltins.cpp b/js/src/methodjit/FastBuiltins.cpp index 840de36abbc6..60339e35692f 100644 --- a/js/src/methodjit/FastBuiltins.cpp +++ b/js/src/methodjit/FastBuiltins.cpp @@ -881,7 +881,7 @@ mjit::Compiler::inlineNativeFunction(uint32_t argc, bool callingNew) */ if (!thisTypes->hasObjectFlags(cx, types::OBJECT_FLAG_NON_DENSE_ARRAY | types::OBJECT_FLAG_ITERATED) && - !arrayPrototypeHasIndexedProperty()) { + !types::ArrayPrototypeHasIndexedProperty(cx, outerScript)) { bool packed = !thisTypes->hasObjectFlags(cx, types::OBJECT_FLAG_NON_PACKED_ARRAY); return compileArrayPopShift(thisValue, packed, native == js::array_pop); } @@ -931,7 +931,7 @@ mjit::Compiler::inlineNativeFunction(uint32_t argc, bool callingNew) * generated by TypeConstraintCall during inference. */ if (!thisTypes->hasObjectFlags(cx, types::OBJECT_FLAG_NON_DENSE_ARRAY) && - !arrayPrototypeHasIndexedProperty()) { + !types::ArrayPrototypeHasIndexedProperty(cx, outerScript)) { return compileArrayPush(thisValue, arg); } } diff --git a/js/src/methodjit/FastOps.cpp b/js/src/methodjit/FastOps.cpp index 19a2c0149302..948ce7eb5575 100644 --- a/js/src/methodjit/FastOps.cpp +++ b/js/src/methodjit/FastOps.cpp @@ -1521,7 +1521,7 @@ mjit::Compiler::jsop_setelem(bool popGuaranteed) types::TypeSet *types = analysis->poppedTypes(PC, 2); if (!types->hasObjectFlags(cx, types::OBJECT_FLAG_NON_DENSE_ARRAY) && - !arrayPrototypeHasIndexedProperty()) { + !types::ArrayPrototypeHasIndexedProperty(cx, outerScript)) { // Inline dense array path. jsop_setelem_dense(); return true; @@ -2113,7 +2113,7 @@ mjit::Compiler::jsop_getelem(bool isCall) if (obj->mightBeType(JSVAL_TYPE_OBJECT) && !types->hasObjectFlags(cx, types::OBJECT_FLAG_NON_DENSE_ARRAY) && - !arrayPrototypeHasIndexedProperty()) { + !types::ArrayPrototypeHasIndexedProperty(cx, outerScript)) { // Inline dense array path. bool packed = !types->hasObjectFlags(cx, types::OBJECT_FLAG_NON_PACKED_ARRAY); jsop_getelem_dense(packed); diff --git a/js/src/methodjit/LoopState.cpp b/js/src/methodjit/LoopState.cpp index 116ed20b856b..84f23d0ddbe8 100644 --- a/js/src/methodjit/LoopState.cpp +++ b/js/src/methodjit/LoopState.cpp @@ -1715,7 +1715,7 @@ LoopState::definiteArrayAccess(const SSAValue &obj, const SSAValue &index) if (objTypes->hasObjectFlags(cx, OBJECT_FLAG_NON_DENSE_ARRAY)) return false; - if (cc.arrayPrototypeHasIndexedProperty()) + if (ArrayPrototypeHasIndexedProperty(cx, outerScript)) return false; uint32_t objSlot;