Bug 1323190 - Attach Proxy GetElem IC. r=jandem

js/src/jit/CacheIR.cpp

@@ -128,6 +128,9 @@ GetPropIRGenerator::tryAttachStub()
 
         MOZ_ASSERT(cacheKind_ == CacheKind::GetElem);
 
+        if (tryAttachProxyElement(obj, objId))
+            return true;
+
         uint32_t index;
         Int32OperandId indexId;
         if (maybeGuardInt32Index(idVal_, getElemKeyValueId(), &index, &indexId)) {
@@ -141,6 +144,7 @@ GetPropIRGenerator::tryAttachStub()
                 return true;
             if (tryAttachArgumentsObjectArg(obj, objId, index, indexId))
                 return true;
+            return false;
         }
 
         return false;
@@ -1119,6 +1123,25 @@ GetPropIRGenerator::tryAttachTypedElement(HandleObject obj, ObjOperandId objId,
     return true;
 }
 
+bool
+GetPropIRGenerator::tryAttachProxyElement(HandleObject obj, ObjOperandId objId)
+{
+    if (!obj->is<ProxyObject>())
+        return false;
+
+    writer.guardIsProxy(objId);
+
+    // We are not guarding against DOM proxies here, because there is no other
+    // specialized DOM IC we could attach.
+    // We could call maybeEmitIdGuard here and then emit CallProxyGetResult,
+    // but for GetElem we prefer to attach a stub that can handle any Value
+    // so we don't attach a new stub for every id.
+    MOZ_ASSERT(cacheKind_ == CacheKind::GetElem);
+    writer.callProxyGetByValueResult(objId, getElemKeyValueId());
+    writer.typeMonitorResult();
+    return true;
+}
+
 void
 GetPropIRGenerator::maybeEmitIdGuard(jsid id)
 {

js/src/jit/CacheIR.h

@@ -765,6 +765,8 @@ class MOZ_RAII GetPropIRGenerator : public IRGenerator
     bool tryAttachTypedElement(HandleObject obj, ObjOperandId objId,
                                uint32_t index, Int32OperandId indexId);
 
+    bool tryAttachProxyElement(HandleObject obj, ObjOperandId objId);
+
     ValOperandId getElemKeyValueId() const {
         MOZ_ASSERT(cacheKind_ == CacheKind::GetElem);
         return ValOperandId(1);