1165392 - Fix some unboxed array bugs

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett [Laid off!]]

Attachment: patch

The attached patch fixes some bugs with unboxed arrays I found while testing.

Comment 1

[Brian Hackett [Laid off!]]

Attachment: baseline cache fixes

The baseline SETELEM caches for unboxed arrays were never being used, and are pretty broken.

Comment 2

[Brian Hackett [Laid off!]]

Attachment: improve JIT lookups

Some more code that is responsible for handling effectless lookups needs to be aware of unboxed arrays.

Comment 3

[Brian Hackett [Laid off!]]

Attachment: add some Ion caches

Add Ion caches for GETELEM and length GETPROP on unboxed arrays.

Comment 4

[Brian Hackett [Laid off!]]

Attachment: optimize concat

Handle unboxed arrays in the Ion optimized version of array.concat

Comment 5

[Jan de Mooij [:jandem]]

Comment on attachment 8606387 [details] [diff] [review]
patch

Review of attachment 8606387 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/MIR.h
@@ +7785,1 @@
>      bool congruentTo(const MDefinition* ins) const override {

congruentTo should check checkNative_ right?

Comment 6

[Jan de Mooij [:jandem]]

Comment on attachment 8607240 [details] [diff] [review]
improve JIT lookups

Review of attachment 8607240 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsobj.cpp
@@ +2812,5 @@
>              }
> +        } else if (obj->is<UnboxedArrayObject>()) {
> +            if (obj->as<UnboxedArrayObject>().containsProperty(cx, id)) {
> +                *objp = obj;
> +                MarkNonNativePropertyFound<NoGC>(propp);

Btw, is fixing the 0x1 shape thing still on your radar? :)

Comment 7

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/57dce88fc620

Comment 8

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/57dce88fc620