mirror of
https://github.com/classilla/tenfourfox.git
synced 2024-08-14 10:29:31 +00:00
#443: M1408412 M1306626 M1404636 M1406398
This commit is contained in:
parent
10268aa6da
commit
622263e71b
@ -710,9 +710,6 @@ EnumerableOwnProperties(JSContext* cx, const JS::CallArgs& args, EnumerableOwnPr
|
||||
RootedId id(cx);
|
||||
RootedValue key(cx);
|
||||
RootedValue value(cx);
|
||||
RootedNativeObject nobj(cx);
|
||||
if (obj->is<NativeObject>())
|
||||
nobj = &obj->as<NativeObject>();
|
||||
RootedShape shape(cx);
|
||||
Rooted<PropertyDescriptor> desc(cx);
|
||||
|
||||
@ -730,7 +727,8 @@ EnumerableOwnProperties(JSContext* cx, const JS::CallArgs& args, EnumerableOwnPr
|
||||
}
|
||||
|
||||
// Step 4.a.i.
|
||||
if (nobj) {
|
||||
if (obj->is<NativeObject>()) {
|
||||
HandleNativeObject nobj = obj.as<NativeObject>();
|
||||
if (JSID_IS_INT(id) && nobj->containsDenseElement(JSID_TO_INT(id))) {
|
||||
value = nobj->getDenseOrTypedArrayElement(JSID_TO_INT(id));
|
||||
} else {
|
||||
|
@ -8616,9 +8616,6 @@ IonBuilder::getElemTryTypedObject(bool* emitted, MDefinition* obj, MDefinition*
|
||||
MOZ_CRASH("Bad kind");
|
||||
}
|
||||
|
||||
static MIRType
|
||||
MIRTypeForTypedArrayRead(Scalar::Type arrayType, bool observedDouble);
|
||||
|
||||
bool
|
||||
IonBuilder::checkTypedObjectIndexInBounds(int32_t elemSize,
|
||||
MDefinition* obj,
|
||||
@ -9510,29 +9507,6 @@ IonBuilder::convertShiftToMaskForStaticTypedArray(MDefinition* id,
|
||||
return ptr;
|
||||
}
|
||||
|
||||
static MIRType
|
||||
MIRTypeForTypedArrayRead(Scalar::Type arrayType, bool observedDouble)
|
||||
{
|
||||
switch (arrayType) {
|
||||
case Scalar::Int8:
|
||||
case Scalar::Uint8:
|
||||
case Scalar::Uint8Clamped:
|
||||
case Scalar::Int16:
|
||||
case Scalar::Uint16:
|
||||
case Scalar::Int32:
|
||||
return MIRType_Int32;
|
||||
case Scalar::Uint32:
|
||||
return observedDouble ? MIRType_Double : MIRType_Int32;
|
||||
case Scalar::Float32:
|
||||
return MIRType_Float32;
|
||||
case Scalar::Float64:
|
||||
return MIRType_Double;
|
||||
default:
|
||||
break;
|
||||
}
|
||||
MOZ_CRASH("Unknown typed array type");
|
||||
}
|
||||
|
||||
bool
|
||||
IonBuilder::jsop_getelem_typed(MDefinition* obj, MDefinition* index,
|
||||
Scalar::Type arrayType)
|
||||
|
@ -3810,6 +3810,9 @@ GetPropertyIC::tryAttachDenseElement(JSContext* cx, HandleScript outerScript, Io
|
||||
if (!obj->isNative() || !idval.isInt32())
|
||||
return true;
|
||||
|
||||
if (uint32_t(idval.toInt32()) >= obj->as<NativeObject>().getDenseInitializedLength())
|
||||
return true;
|
||||
|
||||
*emitted = true;
|
||||
|
||||
MacroAssembler masm(cx, ion, outerScript, profilerLeavePc_);
|
||||
|
@ -5055,6 +5055,14 @@ PropertyReadNeedsTypeBarrier(CompilerConstraintList* constraints,
|
||||
return BarrierKind::TypeSet;
|
||||
}
|
||||
|
||||
if (!name && IsTypedArrayClass(key->clasp())) {
|
||||
Scalar::Type arrayType = Scalar::Type(key->clasp() - &TypedArrayObject::classes[0]);
|
||||
MIRType type = MIRTypeForTypedArrayRead(arrayType, true);
|
||||
if (observed->mightBeMIRType(type))
|
||||
return BarrierKind::NoBarrier;
|
||||
return BarrierKind::TypeSet;
|
||||
}
|
||||
|
||||
jsid id = name ? NameToId(name) : JSID_VOID;
|
||||
HeapTypeSetKey property = key->property(id);
|
||||
if (property.maybeTypes()) {
|
||||
|
@ -14123,6 +14123,29 @@ bool PropertyWriteNeedsTypeBarrier(TempAllocator& alloc, CompilerConstraintList*
|
||||
bool ArrayPrototypeHasIndexedProperty(IonBuilder* builder, JSScript* script);
|
||||
bool TypeCanHaveExtraIndexedProperties(IonBuilder* builder, TemporaryTypeSet* types);
|
||||
|
||||
inline MIRType
|
||||
MIRTypeForTypedArrayRead(Scalar::Type arrayType, bool observedDouble)
|
||||
{
|
||||
switch (arrayType) {
|
||||
case Scalar::Int8:
|
||||
case Scalar::Uint8:
|
||||
case Scalar::Uint8Clamped:
|
||||
case Scalar::Int16:
|
||||
case Scalar::Uint16:
|
||||
case Scalar::Int32:
|
||||
return MIRType_Int32;
|
||||
case Scalar::Uint32:
|
||||
return observedDouble ? MIRType_Double : MIRType_Int32;
|
||||
case Scalar::Float32:
|
||||
return MIRType_Float32;
|
||||
case Scalar::Float64:
|
||||
return MIRType_Double;
|
||||
default:
|
||||
break;
|
||||
}
|
||||
MOZ_CRASH("Unknown typed array type");
|
||||
}
|
||||
|
||||
} // namespace jit
|
||||
} // namespace js
|
||||
|
||||
|
@ -1756,9 +1756,9 @@ MArgumentsLength::computeRange(TempAllocator& alloc)
|
||||
{
|
||||
// This is is a conservative upper bound on what |TooManyActualArguments|
|
||||
// checks. If exceeded, Ion will not be entered in the first place.
|
||||
MOZ_ASSERT(JitOptions.maxStackArgs <= UINT32_MAX,
|
||||
static_assert(ARGS_LENGTH_MAX <= UINT32_MAX,
|
||||
"NewUInt32Range requires a uint32 value");
|
||||
setRange(Range::NewUInt32Range(alloc, 0, JitOptions.maxStackArgs));
|
||||
setRange(Range::NewUInt32Range(alloc, 0, ARGS_LENGTH_MAX));
|
||||
}
|
||||
|
||||
void
|
||||
|
Loading…
Reference in New Issue
Block a user