Bug 469625 - Deoptimize special own-properties, r=brendan.

This commit is contained in:
Graydon Hoare
2009-02-04 11:08:31 -08:00
parent 15cfcf289d
commit 620fdd2aab
4 changed files with 67 additions and 9 deletions

View File

@@ -327,10 +327,20 @@ js_SetProtoOrParent(JSContext *cx, JSObject *obj, uint32 slot, JSObject *pobj)
return JS_FALSE;
}
// Maintain the "any Array prototype has indexed properties hazard" flag.
/*
* Maintain the "any Array prototype has indexed properties hazard" flag by
* conservatively setting it. We simply don't know what pobj has in the way
* of indexed properties, either directly or along its prototype chain, and
* we won't expend effort here to find out. We do know that if obj is not
* an array or a prototype (delegate), then we're ok. And, of course, pobj
* must be non-null.
*
* This pessimistic approach could be improved, but setting __proto__ is
* quite rare and arguably deserving of deoptimization.
*/
if (slot == JSSLOT_PROTO &&
OBJ_IS_ARRAY(cx, pobj) &&
pobj->fslots[JSSLOT_ARRAY_LENGTH] != 0) {
pobj &&
(OBJ_IS_ARRAY(cx, obj) || OBJ_IS_DELEGATE(cx, obj))) {
rt->anyArrayProtoHasElement = JS_TRUE;
}
return JS_TRUE;
@@ -3395,6 +3405,9 @@ js_DefineProperty(JSContext *cx, JSObject *obj, jsid id, jsval value,
* nominal initial value of a slot-full property, while GC safety wants that
* value to be stored before the call-out through the hook. Optimize to do
* both while saving cycles for classes that stub their addProperty hook.
*
* As in js_SetProtoOrParent (see above), we maintain the "any Array prototype
* has indexed properties hazard" flag by conservatively setting it.
*/
#define ADD_PROPERTY_HELPER(cx,clasp,obj,scope,sprop,vp,cleanup) \
JS_BEGIN_MACRO \
@@ -3408,6 +3421,8 @@ js_DefineProperty(JSContext *cx, JSObject *obj, jsid id, jsval value,
LOCKED_OBJ_WRITE_BARRIER(cx, obj, (sprop)->slot, *(vp)); \
} \
} \
if (STOBJ_IS_DELEGATE(obj) && JSID_IS_INT(sprop->id)) \
cx->runtime->anyArrayProtoHasElement = JS_TRUE; \
JS_END_MACRO
JSBool