Bug 469347 - TM: obj.length and slowArray.length don't trace. r=gal

js/src/jstracer.cpp

@@ -9418,11 +9418,22 @@ TraceRecorder::record_JSOP_LENGTH()
     }
 
     JSObject* obj = JSVAL_TO_OBJECT(l);
-    if (!OBJ_IS_DENSE_ARRAY(cx, obj))
-        ABORT_TRACE("only dense arrays supported");
-    if (!guardDenseArray(obj, get(&l)))
-        ABORT_TRACE("OBJ_IS_DENSE_ARRAY but not?!?");
-    LIns* v_ins = lir->ins1(LIR_i2f, stobj_get_fslot(get(&l), JSSLOT_ARRAY_LENGTH));
+    LIns* obj_ins = get(&l);
+    LIns* v_ins;
+    if (OBJ_IS_ARRAY(cx, obj)) {
+        if (OBJ_IS_DENSE_ARRAY(cx, obj)) {
+            if (!guardDenseArray(obj, obj_ins, BRANCH_EXIT))
+                JS_NOT_REACHED("OBJ_IS_DENSE_ARRAY but not?!?");
+        } else {
+            if (!guardClass(obj, obj_ins, &js_SlowArrayClass, snapshot(BRANCH_EXIT)))
+                ABORT_TRACE("can't trace length property access on non-array");
+        }
+        v_ins = lir->ins1(LIR_i2f, stobj_get_fslot(obj_ins, JSSLOT_ARRAY_LENGTH));
+    } else {
+        if (!OBJ_IS_NATIVE(obj))
+            ABORT_TRACE("can't trace length property access on non-array, non-native object");
+        return getProp(obj, obj_ins);
+    }
     set(&l, v_ins);
     return true;
 }

js/src/trace-test.js

@@ -4564,6 +4564,79 @@ function testLengthInString()
 testLengthInString.expected = true;
 test(testLengthInString);
 
+function testSlowArrayLength()
+{
+  var counter = 0;
+  var a = [];
+  a[10000000 - 1] = 0;
+  for (var i = 0; i < a.length; i++)
+    counter++;
+  return counter;
+}
+testSlowArrayLength.expected = 10000000;
+testSlowArrayLength.jitstats = {
+  recorderStarted: 1,
+  recorderAborted: 0,
+  sideExitIntoInterpreter: 1
+};
+test(testSlowArrayLength);
+
+function testObjectLength()
+{
+  var counter = 0;
+  var a = {};
+  a.length = 10000000;
+  for (var i = 0; i < a.length; i++)
+    counter++;
+  return counter;
+}
+testObjectLength.expected = 10000000;
+testObjectLength.jitstats = {
+  recorderStarted: 1,
+  recorderAborted: 0,
+  sideExitIntoInterpreter: 1
+};
+test(testObjectLength);
+
+function testChangingObjectWithLength()
+{
+  var obj = { length: 10 };
+  var dense = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9];
+  var slow = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; slow.slow = 5;
+
+  /*
+   * The elements of objs constitute a De Bruijn sequence repeated 4x to trace
+   * and run native code for every object and transition.
+   */
+  var objs = [obj, obj, obj, obj,
+              obj, obj, obj, obj,
+              dense, dense, dense, dense,
+              obj, obj, obj, obj,
+              slow, slow, slow, slow,
+              dense, dense, dense, dense,
+              dense, dense, dense, dense,
+              slow, slow, slow, slow,
+              slow, slow, slow, slow,
+              obj, obj, obj, obj];
+
+  var counter = 0;
+
+  for (var i = 0, sz = objs.length; i < sz; i++)
+  {
+    var o = objs[i];
+    for (var j = 0; j < o.length; j++)
+      counter++;
+  }
+
+  return counter;
+}
+testChangingObjectWithLength.expected = 400;
+testChangingObjectWithLength.jitstats = {
+  recorderAborted: 0,
+  sideExitIntoInterpreter: 15 // empirically determined
+};
+test(testChangingObjectWithLength);
+
 
 /*****************************************************************************
  *                                                                           *