Closed Bug 713867 Opened 12 years ago Closed 12 years ago

IonMonkey: fix arrayPrototypeHasIndexedProperty

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla12

People

(Reporter: jandem, Assigned: jandem)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

      No description provided.
Attached patch PatchSplinter Review
Move ArrayPrototypeHasIndexedProperty from JM to jsinfer and use it in Ion. The old copy in TypeOracle was incorrect (since ObjShrink landed I guess), so I'd like to have this in one place.

I can land the non-Ion part on inbound first.
Attachment #584572 - Flags: review?(bhackett1024)
Comment on attachment 584572 [details] [diff] [review]
Patch

Review of attachment 584572 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/IonBuilder.cpp
@@ +2786,5 @@
>  
>  bool
>  IonBuilder::jsop_getelem_dense()
>  {
> +    if (types::ArrayPrototypeHasIndexedProperty(cx, script))

Shouldn't this still depend on the oracle?  What if the TI oracle is not in use?

@@ +2848,5 @@
>  
>  bool
>  IonBuilder::jsop_setelem_dense()
>  {
> +    if (types::ArrayPrototypeHasIndexedProperty(cx, script))

Ditto.
Attachment #584572 - Flags: review?(bhackett1024) → review+
(In reply to Brian Hackett (:bhackett) from comment #2)
> 
> Shouldn't this still depend on the oracle?  What if the TI oracle is not in
> use?

Hm agreed, I will move it back to the oracle. Thanks for the quick review!
https://hg.mozilla.org/integration/mozilla-inbound/rev/c377af7c014d

Please don't close this bug, I still have to land the IonMonkey part.
http://hg.mozilla.org/projects/ionmonkey/rev/97109df486a4
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.