Bug 469347 - TM: obj.length and slowArray.length don't trace. r=gal

This commit is contained in:
Jeff Walden 2009-03-17 20:19:57 -07:00
parent 771582b7b4
commit 4a7b00dc77
2 changed files with 89 additions and 5 deletions

View File

@ -9418,11 +9418,22 @@ TraceRecorder::record_JSOP_LENGTH()
} }
JSObject* obj = JSVAL_TO_OBJECT(l); JSObject* obj = JSVAL_TO_OBJECT(l);
if (!OBJ_IS_DENSE_ARRAY(cx, obj)) LIns* obj_ins = get(&l);
ABORT_TRACE("only dense arrays supported"); LIns* v_ins;
if (!guardDenseArray(obj, get(&l))) if (OBJ_IS_ARRAY(cx, obj)) {
ABORT_TRACE("OBJ_IS_DENSE_ARRAY but not?!?"); if (OBJ_IS_DENSE_ARRAY(cx, obj)) {
LIns* v_ins = lir->ins1(LIR_i2f, stobj_get_fslot(get(&l), JSSLOT_ARRAY_LENGTH)); if (!guardDenseArray(obj, obj_ins, BRANCH_EXIT))
JS_NOT_REACHED("OBJ_IS_DENSE_ARRAY but not?!?");
} else {
if (!guardClass(obj, obj_ins, &js_SlowArrayClass, snapshot(BRANCH_EXIT)))
ABORT_TRACE("can't trace length property access on non-array");
}
v_ins = lir->ins1(LIR_i2f, stobj_get_fslot(obj_ins, JSSLOT_ARRAY_LENGTH));
} else {
if (!OBJ_IS_NATIVE(obj))
ABORT_TRACE("can't trace length property access on non-array, non-native object");
return getProp(obj, obj_ins);
}
set(&l, v_ins); set(&l, v_ins);
return true; return true;
} }

View File

@ -4564,6 +4564,79 @@ function testLengthInString()
testLengthInString.expected = true; testLengthInString.expected = true;
test(testLengthInString); test(testLengthInString);
function testSlowArrayLength()
{
var counter = 0;
var a = [];
a[10000000 - 1] = 0;
for (var i = 0; i < a.length; i++)
counter++;
return counter;
}
testSlowArrayLength.expected = 10000000;
testSlowArrayLength.jitstats = {
recorderStarted: 1,
recorderAborted: 0,
sideExitIntoInterpreter: 1
};
test(testSlowArrayLength);
function testObjectLength()
{
var counter = 0;
var a = {};
a.length = 10000000;
for (var i = 0; i < a.length; i++)
counter++;
return counter;
}
testObjectLength.expected = 10000000;
testObjectLength.jitstats = {
recorderStarted: 1,
recorderAborted: 0,
sideExitIntoInterpreter: 1
};
test(testObjectLength);
function testChangingObjectWithLength()
{
var obj = { length: 10 };
var dense = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9];
var slow = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]; slow.slow = 5;
/*
* The elements of objs constitute a De Bruijn sequence repeated 4x to trace
* and run native code for every object and transition.
*/
var objs = [obj, obj, obj, obj,
obj, obj, obj, obj,
dense, dense, dense, dense,
obj, obj, obj, obj,
slow, slow, slow, slow,
dense, dense, dense, dense,
dense, dense, dense, dense,
slow, slow, slow, slow,
slow, slow, slow, slow,
obj, obj, obj, obj];
var counter = 0;
for (var i = 0, sz = objs.length; i < sz; i++)
{
var o = objs[i];
for (var j = 0; j < o.length; j++)
counter++;
}
return counter;
}
testChangingObjectWithLength.expected = 400;
testChangingObjectWithLength.jitstats = {
recorderAborted: 0,
sideExitIntoInterpreter: 15 // empirically determined
};
test(testChangingObjectWithLength);
/***************************************************************************** /*****************************************************************************
* * * *