From cbec12046bd122a3e5ec0680721539066f081fc3 Mon Sep 17 00:00:00 2001
From: "Nicolas B. Pierron" <npierron@mozilla.com>
Date: Fri, 28 Sep 2012 22:58:53 -0700
Subject: [PATCH] Backout a2843362ce9b (Bug 786126) - Are we fast yet
 regression.

---
 js/src/ion/TypeOracle.cpp | 10 ----------
 js/src/jsanalyze.h        |  9 ++++-----
 js/src/jsinterpinlines.h  | 25 ++++++++++---------------
 3 files changed, 14 insertions(+), 30 deletions(-)

diff --git a/js/src/ion/TypeOracle.cpp b/js/src/ion/TypeOracle.cpp
index 3c285dc11a5..0f102ab96e5 100644
--- a/js/src/ion/TypeOracle.cpp
+++ b/js/src/ion/TypeOracle.cpp
@@ -373,16 +373,6 @@ TypeInferenceOracle::elementReadGeneric(JSScript *script, jsbytecode *pc, bool *
 
     *cacheable = (obj == MIRType_Object &&
                   (id == MIRType_Value || id == MIRType_Int32 || id == MIRType_String));
-
-    // Turn off cacheing if the element is int32 and we've seen non-native objects as the target
-    // of this getelem.
-    if (*cacheable) {
-        if (id == MIRType_Int32) {
-            if (script->analysis()->getCode(pc).nonNativeGetElement)
-                *cacheable = false;
-        }
-    }
-
     if (*cacheable)
         *monitorResult = (id == MIRType_String || script->analysis()->getCode(pc).getStringElement);
     else
diff --git a/js/src/jsanalyze.h b/js/src/jsanalyze.h
index 8456aebe217..1d37f696853 100644
--- a/js/src/jsanalyze.h
+++ b/js/src/jsanalyze.h
@@ -111,11 +111,10 @@ class Bytecode
      * Dynamically observed state about the execution of this opcode. These are
      * hints about the script for use during compilation.
      */
-    bool arrayWriteHole: 1;     /* SETELEM which has written to an array hole. */
-    bool getStringElement:1;    /* GETELEM which has accessed string properties. */
-    bool nonNativeGetElement:1; /* GETELEM on a non-native object. */
-    bool accessGetter: 1;       /* Property read on a shape with a getter hook. */
-    bool notIdempotent: 1;      /* Don't use an idempotent cache for this property read. */
+    bool arrayWriteHole: 1;  /* SETELEM which has written to an array hole. */
+    bool getStringElement:1; /* GETELEM which has accessed string properties. */
+    bool accessGetter: 1;    /* Property read on a shape with a getter hook. */
+    bool notIdempotent: 1;   /* Don't use an idempotent cache for this property read. */
 
     /* Stack depth before this opcode. */
     uint32_t stackDepth;
diff --git a/js/src/jsinterpinlines.h b/js/src/jsinterpinlines.h
index bb47f97d909..dc84c572f7a 100644
--- a/js/src/jsinterpinlines.h
+++ b/js/src/jsinterpinlines.h
@@ -686,19 +686,6 @@ GetObjectElementOperation(JSContext *cx, JSOp op, HandleObject obj, const Value
     }
 #endif
 
-    bool updateAnalysis = false;
-    RootedScript script(cx, NULL);
-    jsbytecode *pc = NULL;
-    if (!cx->fp()->beginsIonActivation()) {
-        // Don't call GetPcScript from inside Ion since it's expensive.
-        types::TypeScript::GetPcScript(cx, &script, &pc);
-        if (script->hasAnalysis())
-            updateAnalysis = true;
-    }
-
-    if (updateAnalysis && !obj->isNative())
-        script->analysis()->getCode(pc).nonNativeGetElement = true;
-
     uint32_t index;
     if (IsDefinitelyIndex(rref, &index)) {
         do {
@@ -716,8 +703,16 @@ GetObjectElementOperation(JSContext *cx, JSOp op, HandleObject obj, const Value
                 return false;
         } while(0);
     } else {
-        if (updateAnalysis)
-            script->analysis()->getCode(pc).getStringElement = true;
+        if (!cx->fp()->beginsIonActivation()) {
+            // Don't update getStringElement if called from Ion code, since
+            // ion::GetPcScript is expensive.
+            RootedScript script(cx);
+            jsbytecode *pc;
+            types::TypeScript::GetPcScript(cx, &script, &pc);
+
+            if (script->hasAnalysis())
+                script->analysis()->getCode(pc).getStringElement = true;
+        }
 
         SpecialId special;
         res.set(rref);