wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 865626 - Disallow generating extra barrier instructions when compiling Array.push, r=dvander.

Browse Source
This commit is contained in:
Brian Hackett 2013-04-25 15:22:04 -06:00
parent 6b4ae93176
commit 0d0c29df01
3 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
js/src/ion/MCallOptimize.cpp
View File

@ -311,10 +311,9 @@ IonBuilder::inlineArrayPush(CallInfo &callInfo)
MDefinition *obj = callInfo.thisArg();
MDefinition *value = callInfo.getArg(0);
if (PropertyWriteNeedsTypeBarrier(cx, current, &obj, NULL, &value))
return InliningStatus_NotInlined;
if (obj != callInfo.thisArg() || value != callInfo.getArg(0))
if (PropertyWriteNeedsTypeBarrier(cx, current, &obj, NULL, &value, /* canModify = */ false))
return InliningStatus_NotInlined;
JS_ASSERT(obj == callInfo.thisArg() && value == callInfo.getArg(0));
if (getInlineReturnType() != MIRType_Int32)
return InliningStatus_NotInlined;
@ -926,7 +925,7 @@ IonBuilder::inlineUnsafeSetElement(CallInfo &callInfo)
MDefinition *id = callInfo.getArg(idxi);
MDefinition *elem = callInfo.getArg(elemi);
if (PropertyWriteNeedsTypeBarrier(cx, current, &obj, NULL, &elem))
if (PropertyWriteNeedsTypeBarrier(cx, current, &obj, NULL, &elem, /* canModify = */ false))
return InliningStatus_NotInlined;
int arrayType;

8
js/src/ion/MIR.cpp
View File

@ -2493,7 +2493,7 @@ AddTypeGuard(MBasicBlock *current, MDefinition *obj, types::TypeObject *typeObje
bool
ion::PropertyWriteNeedsTypeBarrier(JSContext *cx, MBasicBlock *current, MDefinition **pobj,
PropertyName *name, MDefinition **pvalue)
PropertyName *name, MDefinition **pvalue, bool canModify)
{
// If any value being written is not reflected in the type information for
// objects which obj could represent, a type barrier is needed when writing
@ -2535,6 +2535,12 @@ ion::PropertyWriteNeedsTypeBarrier(JSContext *cx, MBasicBlock *current, MDefinit
break;
}
if (!TypeSetIncludes(property, (*pvalue)->type(), (*pvalue)->resultTypeSet())) {
// Either pobj or pvalue needs to be modified to filter out the
// types which the value could have but are not in the property,
// or a VM call is required. A VM call is always required if pobj
// and pvalue cannot be modified.
if (!canModify)
return true;
success = TryAddTypeBarrierForWrite(cx, current, types, id, pvalue);
break;
}

3
js/src/ion/MIR.h
View File

@ -7725,7 +7725,8 @@ bool PropertyReadNeedsTypeBarrier(JSContext *cx, MDefinition *obj, PropertyName
types::StackTypeSet *observed);
bool PropertyReadIsIdempotent(JSContext *cx, MDefinition *obj, PropertyName *name);
bool PropertyWriteNeedsTypeBarrier(JSContext *cx, MBasicBlock *current, MDefinition **pobj,
PropertyName *name, MDefinition **pvalue);
PropertyName *name, MDefinition **pvalue,
bool canModify = true);
} // namespace ion
} // namespace js