Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-11 18:24:02 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1057571 - Allow copy on write arrays in non-compileAndGo code, r=jandem.

Browse Source
This commit is contained in:
Brian Hackett 2014-08-27 09:12:10 -07:00
parent f4e1c39bb7
commit 972c7e4cf6
4 changed files with 37 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
js/src/frontend/BytecodeEmitter.cpp
View File

@ -6673,7 +6673,6 @@ frontend::EmitTree(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
// every time the initializer executes.
RootedValue value(cx);
if (bce->emitterMode != BytecodeEmitter::SelfHosting &&
bce->script->compileAndGo() &&
pn->pn_count != 0 &&
pn->getConstantValue(cx, ParseNode::DontAllowNestedObjects, &value))
{

14
js/src/jit-test/tests/basic/bug1057571.js Normal file
View File

@ -0,0 +1,14 @@
test = (function () {
function f() {
[1,2,3,4,5];
};
return "var obj = { x : 2 };" + f.toSource() + "; f()";
})();
evalWithCache(test, {});
function evalWithCache(code, ctx) {
code = cacheEntry(code);
ctx.compileAndGo = true;
var res1 = evaluate(code, Object.create(ctx, {saveBytecode: { value: true } }));
var res2 = evaluate(code, Object.create(ctx, {loadBytecode: { value: true }, saveBytecode: { value: true } }));
}

25
js/src/jsobj.cpp
View File

@ -1999,7 +1999,8 @@ JSObject *
js::DeepCloneObjectLiteral(JSContext *cx, HandleObject obj, NewObjectKind newKind)
{
/* NB: Keep this in sync with XDRObjectLiteral. */
JS_ASSERT(JS::CompartmentOptionsRef(cx).getSingletonsAsTemplates());
JS_ASSERT_IF(obj->hasSingletonType(),
JS::CompartmentOptionsRef(cx).getSingletonsAsTemplates());
JS_ASSERT(obj->is<JSObject>() || obj->is<ArrayObject>());
// Result of the clone function.
@ -2009,7 +2010,7 @@ js::DeepCloneObjectLiteral(JSContext *cx, HandleObject obj, NewObjectKind newKin
RootedValue v(cx);
RootedObject deepObj(cx);
if (obj->getClass() == &ArrayObject::class_) {
if (obj->is<ArrayObject>()) {
clone = NewDenseUnallocatedArray(cx, obj->as<ArrayObject>().length(), nullptr, newKind);
} else {
// Object literals are tenured by default as holded by the JSScript.
@ -2073,6 +2074,11 @@ js::DeepCloneObjectLiteral(JSContext *cx, HandleObject obj, NewObjectKind newKin
FixObjectType(cx, clone);
}
if (obj->is<ArrayObject>() && obj->denseElementsAreCopyOnWrite()) {
if (!ObjectElements::MakeElementsCopyOnWrite(cx, clone))
return nullptr;
}
return clone;
}
@ -2083,7 +2089,8 @@ js::XDRObjectLiteral(XDRState<mode> *xdr, MutableHandleObject obj)
/* NB: Keep this in sync with DeepCloneObjectLiteral. */
JSContext *cx = xdr->cx();
JS_ASSERT_IF(mode == XDR_ENCODE, JS::CompartmentOptionsRef(cx).getSingletonsAsTemplates());
JS_ASSERT_IF(mode == XDR_ENCODE && obj->hasSingletonType(),
JS::CompartmentOptionsRef(cx).getSingletonsAsTemplates());
// Distinguish between objects and array classes.
uint32_t isArray = 0;
@ -2288,6 +2295,18 @@ js::XDRObjectLiteral(XDRState<mode> *xdr, MutableHandleObject obj)
}
}
if (isArray) {
uint32_t copyOnWrite;
if (mode == XDR_ENCODE)
copyOnWrite = obj->denseElementsAreCopyOnWrite();
if (!xdr->codeUint32(&copyOnWrite))
return false;
if (mode == XDR_DECODE && copyOnWrite) {
if (!ObjectElements::MakeElementsCopyOnWrite(cx, obj))
return false;
}
}
return true;
}

2
js/src/vm/Xdr.h
View File

@ -28,7 +28,7 @@ namespace js {
*
* https://developer.mozilla.org/en-US/docs/SpiderMonkey/Internals/Bytecode
*/
static const uint32_t XDR_BYTECODE_VERSION = uint32_t(0xb973c0de - 181);
static const uint32_t XDR_BYTECODE_VERSION = uint32_t(0xb973c0de - 182);
class XDRBuffer {
public: