[JAEGER] Fix GETPROP bug with dense arrays.

This commit is contained in:
David Anderson 2010-06-22 16:53:35 -07:00
parent 4e21a7e40e
commit 82f5e8e60e

View File

@ -395,12 +395,13 @@ class SetPropCompiler : public PICStubCompiler
return disable("invalid slot"); return disable("invalid slot");
JS_ASSERT(obj == holder); JS_ASSERT(obj == holder);
if (!pic.inlinePathPatched && !scope->brandedOrHasMethodBarrier()) if (!pic.inlinePathPatched &&
!scope->brandedOrHasMethodBarrier() &&
!obj->isDenseArray()) {
return patchInline(sprop); return patchInline(sprop);
else }
return generateStub(sprop);
return true; return generateStub(sprop);
} }
}; };
@ -581,14 +582,25 @@ class GetPropCompiler : public PICStubCompiler
masm.move(RegisterID(pic.objRemat()), pic.objReg); masm.move(RegisterID(pic.objRemat()), pic.objReg);
pic.u.get.objNeedsRemat = false; pic.u.get.objNeedsRemat = false;
} }
Label start;
Jump shapeGuard;
if (obj->isDenseArray()) {
start = masm.label();
shapeGuard = masm.branchPtr(Assembler::NotEqual,
Address(pic.objReg, offsetof(JSObject, clasp)),
ImmPtr(obj->getClass()));
} else {
if (pic.shapeNeedsRemat()) { if (pic.shapeNeedsRemat()) {
masm.loadShape(pic.objReg, pic.shapeReg); masm.loadShape(pic.objReg, pic.shapeReg);
pic.u.get.shapeRegHasBaseShape = true; pic.u.get.shapeRegHasBaseShape = true;
} }
Label start = masm.label(); start = masm.label();
Jump shapeGuard = masm.branch32_force32(Assembler::NotEqual, pic.shapeReg, shapeGuard = masm.branch32_force32(Assembler::NotEqual, pic.shapeReg,
Imm32(obj->shape())); Imm32(obj->shape()));
}
if (!shapeMismatches.append(shapeGuard)) if (!shapeMismatches.append(shapeGuard))
return false; return false;
@ -655,6 +667,8 @@ class GetPropCompiler : public PICStubCompiler
if (pic.stubsGenerated == MAX_STUBS) if (pic.stubsGenerated == MAX_STUBS)
disable("max stubs reached"); disable("max stubs reached");
if (obj->isDenseArray())
disable("dense array");
return true; return true;
} }