Bugzilla

Description: Part 1 - Fix

Filename:

MIME Type:

Creator: Jan de Mooij [:jandem]

Size: 4.64 KB

patch

># HG changeset patch ># Parent 641d9a23bb4ec76b4dbc4f8600566a29c1e8b28c > >diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp >--- a/js/src/jit/IonBuilder.cpp >+++ b/js/src/jit/IonBuilder.cpp >@@ -7790,19 +7790,16 @@ IonBuilder::getElemTryTypedObject(bool* > index, > objPrediction, > elemPrediction); > } > > MOZ_CRASH("Bad kind"); > } > >-static MIRType >-MIRTypeForTypedArrayRead(Scalar::Type arrayType, bool observedDouble); >- > bool > IonBuilder::checkTypedObjectIndexInBounds(uint32_t elemSize, > MDefinition* obj, > MDefinition* index, > TypedObjectPrediction objPrediction, > LinearSum* indexAsByteOffset) > { > // Ensure index is an integer. >@@ -8748,39 +8745,16 @@ IonBuilder::convertShiftToMaskForStaticT > MOZ_ASSERT(!ptr->isEffectful()); > > current->add(mask); > current->add(ptr); > > return ptr; > } > >-static MIRType >-MIRTypeForTypedArrayRead(Scalar::Type arrayType, bool observedDouble) >-{ >- switch (arrayType) { >- case Scalar::Int8: >- case Scalar::Uint8: >- case Scalar::Uint8Clamped: >- case Scalar::Int16: >- case Scalar::Uint16: >- case Scalar::Int32: >- return MIRType::Int32; >- case Scalar::Uint32: >- return observedDouble ? MIRType::Double : MIRType::Int32; >- case Scalar::Float32: >- return MIRType::Float32; >- case Scalar::Float64: >- return MIRType::Double; >- default: >- break; >- } >- MOZ_CRASH("Unknown typed array type"); >-} >- > AbortReasonOr<Ok> > IonBuilder::jsop_getelem_typed(MDefinition* obj, MDefinition* index, > Scalar::Type arrayType) > { > TemporaryTypeSet* types = bytecodeTypes(pc); > > bool maybeUndefined = types->hasType(TypeSet::UndefinedType()); > >diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp >--- a/js/src/jit/MIR.cpp >+++ b/js/src/jit/MIR.cpp >@@ -6188,16 +6188,24 @@ PropertyReadNeedsTypeBarrier(CompilerCon > // We also need a barrier if the object is a proxy, because then all bets > // are off, just as if it has unknown properties. > if (key->unknownProperties() || observed->empty() || > key->clasp()->isProxy()) > { > return BarrierKind::TypeSet; > } > >+ if (!name && IsTypedArrayClass(key->clasp())) { >+ Scalar::Type arrayType = Scalar::Type(key->clasp() - &TypedArrayObject::classes[0]); >+ MIRType type = MIRTypeForTypedArrayRead(arrayType, true); >+ if (observed->mightBeMIRType(type)) >+ return BarrierKind::NoBarrier; >+ return BarrierKind::TypeSet; >+ } >+ > jsid id = name ? NameToId(name) : JSID_VOID; > HeapTypeSetKey property = key->property(id); > if (property.maybeTypes()) { > if (!TypeSetIncludes(observed, MIRType::Value, property.maybeTypes())) { > // If all possible objects have been observed, we don't have to > // guard on the specific object types. > if (property.maybeTypes()->objectsAreSubset(observed)) { > property.freeze(constraints); >diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h >--- a/js/src/jit/MIR.h >+++ b/js/src/jit/MIR.h >@@ -14951,16 +14951,39 @@ bool PropertyWriteNeedsTypeBarrier(TempA > MBasicBlock* current, MDefinition** pobj, > PropertyName* name, MDefinition** pvalue, > bool canModify, MIRType implicitType = MIRType::None); > AbortReasonOr<bool> > ArrayPrototypeHasIndexedProperty(IonBuilder* builder, JSScript* script); > AbortReasonOr<bool> > TypeCanHaveExtraIndexedProperties(IonBuilder* builder, TemporaryTypeSet* types); > >+inline MIRType >+MIRTypeForTypedArrayRead(Scalar::Type arrayType, bool observedDouble) >+{ >+ switch (arrayType) { >+ case Scalar::Int8: >+ case Scalar::Uint8: >+ case Scalar::Uint8Clamped: >+ case Scalar::Int16: >+ case Scalar::Uint16: >+ case Scalar::Int32: >+ return MIRType::Int32; >+ case Scalar::Uint32: >+ return observedDouble ? MIRType::Double : MIRType::Int32; >+ case Scalar::Float32: >+ return MIRType::Float32; >+ case Scalar::Float64: >+ return MIRType::Double; >+ default: >+ break; >+ } >+ MOZ_CRASH("Unknown typed array type"); >+} >+ > } // namespace jit > } // namespace js > > // Specialize the AlignmentFinder class to make Result<V, E> works with abstract > // classes such as MDefinition*, and MInstruction* > namespace mozilla > { >

Flags:

bhackett1024: review+
lizzard: approval-mozilla-beta+
lizzard: approval-mozilla-esr52+
abillings: sec-approval+