822208 - BaselineCompiler: Compile INITELEM_ARRAY

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Attachment: Patch

Pretty straight-forward with bug 821816 fixed.

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

Comment 2

[Kannan Vijayan [:djvj]]

Comment on attachment 692900 [details] [diff] [review]
Patch

Review of attachment 692900 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/BaselineCompiler.cpp
@@ +905,5 @@
> +    masm.extractObject(frame.addressOfStackValue(array), scratch);
> +    masm.loadPtr(Address(scratch, JSObject::offsetOfElements()), scratch);
> +
> +    // Update initialized length.
> +    masm.store32(Imm32(index + 1), Address(scratch, ObjectElements::offsetOfInitializedLength()));

Is the array ever accessible in js code before it's been fully initialized?  If not, we can set the initialized length in NewArray and avoid updating it on each INITELEM.

Comment 3

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/projects/ionmonkey/rev/c4bd7021e0ed

(In reply to Kannan Vijayan [:djvj] from comment #2)
> 
> Is the array ever accessible in js code before it's been fully initialized? 
> If not, we can set the initialized length in NewArray and avoid updating it
> on each INITELEM.

The array is not accessible in js code, but the GC may access it, like [{}, gc()]