wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 894881 - Fix JIT fast paths to work with typed array properties. r=bhackett

Browse Source
This commit is contained in:
Jan de Mooij 2013-11-19 19:21:11 +01:00
parent fa9bd3e7b1
commit f5c053ab6b
2 changed files with 21 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
js/src/jit/BaselineIC.cpp
View File

@ -3269,10 +3269,14 @@ EffectlesslyLookupProperty(JSContext *cx, HandleObject obj, HandlePropertyName n
*domProxyHasGeneration = (*shadowsResult == DoesntShadowUnique);
checkObj = GetDOMProxyProto(obj);
}
if (!isDOMProxy && !obj->isNative())
} else if (obj->is<TypedArrayObject>() && obj->getProto()) {
// Typed array objects are non-native, but don't have any named
// properties. Just forward the lookup to the prototype, to allow
// inlining common getters like byteOffset.
checkObj = obj->getProto();
} else if (!obj->isNative()) {
return true;
}
if (checkObj->hasIdempotentProtoChain()) {
if (!JSObject::lookupProperty(cx, checkObj, name, holder, shape))
@ -3289,7 +3293,7 @@ static bool
IsCacheableProtoChain(JSObject *obj, JSObject *holder, bool isDOMProxy=false)
{
JS_ASSERT_IF(isDOMProxy, IsCacheableDOMProxy(obj));
JS_ASSERT_IF(!isDOMProxy, obj->isNative());
JS_ASSERT_IF(!isDOMProxy, obj->isNative() || obj->is<TypedArrayObject>());
// Don't handle objects which require a prototype guard. This should
// be uncommon so handling it is likely not worth the complexity.
@ -5974,7 +5978,7 @@ TryAttachNativeGetPropStub(JSContext *cx, HandleScript script, jsbytecode *pc,
return false;
}
if (!isDOMProxy && !obj->isNative())
if (!isDOMProxy && !obj->isNative() && !obj->is<TypedArrayObject>())
return true;
bool isCallProp = (JSOp(*pc) == JSOP_CALLPROP);

17
js/src/jit/IonBuilder.cpp
View File

@ -5934,8 +5934,14 @@ IonBuilder::maybeInsertResume()
}
static bool
ClassHasEffectlessLookup(const Class *clasp)
ClassHasEffectlessLookup(const Class *clasp, PropertyName *name)
{
if (IsTypedArrayClass(clasp)) {
// Typed arrays have a lookupGeneric hook, but it only handles
// integers, not names.
JS_ASSERT(name);
return true;
}
return clasp->isNative() && !clasp->ops.lookupGeneric;
}
@ -5974,7 +5980,7 @@ IonBuilder::testSingletonProperty(JSObject *obj, PropertyName *name)
// property will change and trigger invalidation.
while (obj) {
if (!ClassHasEffectlessLookup(obj->getClass()))
if (!ClassHasEffectlessLookup(obj->getClass(), name))
return nullptr;
types::TypeObjectKey *objType = types::TypeObjectKey::get(obj);
@ -7785,12 +7791,13 @@ IonBuilder::objectsHaveCommonPrototype(types::TemporaryTypeSet *types, PropertyN
return false;
const Class *clasp = type->clasp();
if (!ClassHasEffectlessLookup(clasp) || ClassHasResolveHook(compartment, clasp, name))
if (!ClassHasEffectlessLookup(clasp, name) || ClassHasResolveHook(compartment, clasp, name))
return false;
// Look for a getter/setter on the class itself which may need
// to be called.
if (isGetter && clasp->ops.getGeneric)
// to be called. Ignore the getGeneric hook for typed arrays, it
// only handles integers and forwards names to the prototype.
if (isGetter && clasp->ops.getGeneric && !IsTypedArrayClass(clasp))
return false;
if (!isGetter && clasp->ops.setGeneric)
return false;