Bug 1544386 part 1 - Call ElementAccessHasExtraIndexedProperty instea…

…d of ArrayPrototypeHasIndexedProperty when inlining array natives. r=tcampbell a=lizzard
BrowserWorks · Jun 19, 2019 · 27ce846 · 27ce846
1 parent 3d73512
commit 27ce846
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 27 deletions.
diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
@@ -701,7 +701,7 @@ IonBuilder::inlineArrayPopShift(CallInfo& callInfo, MArrayPopShift::Mode mode)
     }
 
     bool hasIndexedProperty;
-    MOZ_TRY_VAR(hasIndexedProperty, ArrayPrototypeHasIndexedProperty(this, script()));
+    MOZ_TRY_VAR(hasIndexedProperty, ElementAccessHasExtraIndexedProperty(this, obj));
     if (hasIndexedProperty) {
         trackOptimizationOutcome(TrackedOutcome::ProtoIndexedProps);
         return InliningStatus_NotInlined;
@@ -799,15 +799,9 @@ IonBuilder::inlineArrayPush(CallInfo& callInfo)
     const Class* clasp = thisTypes->getKnownClass(constraints());
     if (clasp != &ArrayObject::class_ && clasp != &UnboxedArrayObject::class_)
         return InliningStatus_NotInlined;
-    if (thisTypes->hasObjectFlags(constraints(), OBJECT_FLAG_SPARSE_INDEXES |
-                                  OBJECT_FLAG_LENGTH_OVERFLOW))
-    {
-        trackOptimizationOutcome(TrackedOutcome::ArrayBadFlags);
-        return InliningStatus_NotInlined;
-    }
 
     bool hasIndexedProperty;
-    MOZ_TRY_VAR(hasIndexedProperty, ArrayPrototypeHasIndexedProperty(this, script()));
+    MOZ_TRY_VAR(hasIndexedProperty, ElementAccessHasExtraIndexedProperty(this, obj));
     if (hasIndexedProperty) {
         trackOptimizationOutcome(TrackedOutcome::ProtoIndexedProps);
         return InliningStatus_NotInlined;
@@ -885,12 +879,6 @@ IonBuilder::inlineArraySlice(CallInfo& callInfo)
     const Class* clasp = thisTypes->getKnownClass(constraints());
     if (clasp != &ArrayObject::class_ && clasp != &UnboxedArrayObject::class_)
         return InliningStatus_NotInlined;
-    if (thisTypes->hasObjectFlags(constraints(), OBJECT_FLAG_SPARSE_INDEXES |
-                                  OBJECT_FLAG_LENGTH_OVERFLOW))
-    {
-        trackOptimizationOutcome(TrackedOutcome::ArrayBadFlags);
-        return InliningStatus_NotInlined;
-    }
 
     JSValueType unboxedType = JSVAL_TYPE_MAGIC;
     if (clasp == &UnboxedArrayObject::class_) {
@@ -899,9 +887,9 @@ IonBuilder::inlineArraySlice(CallInfo& callInfo)
             return InliningStatus_NotInlined;
     }
 
-    // Watch out for indexed properties on the prototype.
+    // Watch out for extra indexed properties on the object or its prototype.
     bool hasIndexedProperty;
-    MOZ_TRY_VAR(hasIndexedProperty, ArrayPrototypeHasIndexedProperty(this, script()));
+    MOZ_TRY_VAR(hasIndexedProperty, ElementAccessHasExtraIndexedProperty(this, obj));
     if (hasIndexedProperty) {
         trackOptimizationOutcome(TrackedOutcome::ProtoIndexedProps);
         return InliningStatus_NotInlined;

diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
@@ -6387,15 +6387,6 @@ PrototypeHasIndexedProperty(IonBuilder* builder, JSObject* obj)
     return false;
 }
 
-// Whether Array.prototype, or an object on its proto chain, has an indexed property.
-AbortReasonOr<bool>
-jit::ArrayPrototypeHasIndexedProperty(IonBuilder* builder, JSScript* script)
-{
-    if (JSObject* proto = script->global().maybeGetArrayPrototype())
-        return PrototypeHasIndexedProperty(builder, proto);
-    return true;
-}
-
 // Whether obj or any of its prototypes have an indexed property.
 AbortReasonOr<bool>
 jit::TypeCanHaveExtraIndexedProperties(IonBuilder* builder, TemporaryTypeSet* types)

diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
@@ -14907,8 +14907,6 @@ bool PropertyWriteNeedsTypeBarrier(TempAllocator& alloc, CompilerConstraintList*
                                    PropertyName* name, MDefinition** pvalue,
                                    bool canModify, MIRType implicitType = MIRType::None);
 AbortReasonOr<bool>
-ArrayPrototypeHasIndexedProperty(IonBuilder* builder, JSScript* script);
-AbortReasonOr<bool>
 TypeCanHaveExtraIndexedProperties(IonBuilder* builder, TemporaryTypeSet* types);
 
 inline MIRType