From ab7b5f66979b534d639081d0a2ca8388233b6b31 Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Thu, 26 Oct 2017 16:15:35 +0200
Subject: [PATCH] Bug 1404636 - Special-case typed arrays in
 PropertyReadNeedsTypeBarrier. r=bhackett

---
 js/src/jit/IonBuilder.cpp | 26 --------------------------
 js/src/jit/MIR.cpp        |  8 ++++++++
 js/src/jit/MIR.h          | 23 +++++++++++++++++++++++
 3 files changed, 31 insertions(+), 26 deletions(-)

diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 08a4def7c2d9..bb507d60898d 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -7806,9 +7806,6 @@ IonBuilder::getElemTryTypedObject(bool* emitted, MDefinition* obj, MDefinition*
     MOZ_CRASH("Bad kind");
 }
 
-static MIRType
-MIRTypeForTypedArrayRead(Scalar::Type arrayType, bool observedDouble);
-
 bool
 IonBuilder::checkTypedObjectIndexInBounds(uint32_t elemSize,
                                           MDefinition* obj,
@@ -8764,29 +8761,6 @@ IonBuilder::convertShiftToMaskForStaticTypedArray(MDefinition* id,
     return ptr;
 }
 
-static MIRType
-MIRTypeForTypedArrayRead(Scalar::Type arrayType, bool observedDouble)
-{
-    switch (arrayType) {
-      case Scalar::Int8:
-      case Scalar::Uint8:
-      case Scalar::Uint8Clamped:
-      case Scalar::Int16:
-      case Scalar::Uint16:
-      case Scalar::Int32:
-        return MIRType::Int32;
-      case Scalar::Uint32:
-        return observedDouble ? MIRType::Double : MIRType::Int32;
-      case Scalar::Float32:
-        return MIRType::Float32;
-      case Scalar::Float64:
-        return MIRType::Double;
-      default:
-        break;
-    }
-    MOZ_CRASH("Unknown typed array type");
-}
-
 AbortReasonOr<Ok>
 IonBuilder::jsop_getelem_typed(MDefinition* obj, MDefinition* index,
                                Scalar::Type arrayType)
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index b381376cb7ac..0d94faff1fb3 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -6193,6 +6193,14 @@ PropertyReadNeedsTypeBarrier(CompilerConstraintList* constraints,
         return BarrierKind::TypeSet;
     }
 
+    if (!name && IsTypedArrayClass(key->clasp())) {
+        Scalar::Type arrayType = Scalar::Type(key->clasp() - &TypedArrayObject::classes[0]);
+        MIRType type = MIRTypeForTypedArrayRead(arrayType, true);
+        if (observed->mightBeMIRType(type))
+            return BarrierKind::NoBarrier;
+        return BarrierKind::TypeSet;
+    }
+
     jsid id = name ? NameToId(name) : JSID_VOID;
     HeapTypeSetKey property = key->property(id);
     if (property.maybeTypes()) {
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 27b190a30f37..bb7e79bb737f 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -15002,6 +15002,29 @@ ArrayPrototypeHasIndexedProperty(IonBuilder* builder, JSScript* script);
 AbortReasonOr<bool>
 TypeCanHaveExtraIndexedProperties(IonBuilder* builder, TemporaryTypeSet* types);
 
+inline MIRType
+MIRTypeForTypedArrayRead(Scalar::Type arrayType, bool observedDouble)
+{
+    switch (arrayType) {
+      case Scalar::Int8:
+      case Scalar::Uint8:
+      case Scalar::Uint8Clamped:
+      case Scalar::Int16:
+      case Scalar::Uint16:
+      case Scalar::Int32:
+        return MIRType::Int32;
+      case Scalar::Uint32:
+        return observedDouble ? MIRType::Double : MIRType::Int32;
+      case Scalar::Float32:
+        return MIRType::Float32;
+      case Scalar::Float64:
+        return MIRType::Double;
+      default:
+        break;
+    }
+    MOZ_CRASH("Unknown typed array type");
+}
+
 } // namespace jit
 } // namespace js