From 370d4dd7e42ebc785fc444f4dbe8114196852b9d Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Mon, 21 Nov 2011 18:33:55 -0500
Subject: [PATCH] Speed up adding new properties with a common base shape, bug
 704327.

---
 js/src/jsscope.cpp      | 15 ++++++++++-----
 js/src/jsscope.h        |  5 ++++-
 js/src/jsscopeinlines.h |  6 ++++++
 3 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/js/src/jsscope.cpp b/js/src/jsscope.cpp
index 26bd0c074492..4e82df129773 100644
--- a/js/src/jsscope.cpp
+++ b/js/src/jsscope.cpp
@@ -657,11 +657,16 @@ JSObject::addPropertyInternal(JSContext *cx, jsid id,
     /* Find or create a property tree node labeled by our arguments. */
     Shape *shape;
     {
-        BaseShape base(getClass(), getParent(), lastProperty()->getObjectFlags(),
-                       attrs, getter, setter);
-        BaseShape *nbase = BaseShape::getUnowned(cx, base);
-        if (!nbase)
-            return NULL;
+        BaseShape *nbase;
+        if (lastProperty()->base()->matchesGetterSetter(getter, setter)) {
+            nbase = lastProperty()->base();
+        } else {
+            BaseShape base(getClass(), getParent(), lastProperty()->getObjectFlags(),
+                           attrs, getter, setter);
+            nbase = BaseShape::getUnowned(cx, base);
+            if (!nbase)
+                return NULL;
+        }
 
         Shape child(nbase, id, slot, numFixedSlots(), attrs, flags, shortid);
         shape = getChildProperty(cx, lastProperty(), child);
diff --git a/js/src/jsscope.h b/js/src/jsscope.h
index 8df6db57142f..b4ba07ae9fbd 100644
--- a/js/src/jsscope.h
+++ b/js/src/jsscope.h
@@ -412,10 +412,13 @@ class BaseShape : public js::gc::Cell
 
     inline BaseShape(Class *clasp, JSObject *parent, uint32 objectFlags);
     inline BaseShape(Class *clasp, JSObject *parent, uint32 objectFlags,
-                     uint8 attrs, js::PropertyOp rawGetter, js::StrictPropertyOp rawSetter);
+                     uint8 attrs, PropertyOp rawGetter, StrictPropertyOp rawSetter);
 
     bool isOwned() const { return !!(flags & OWNED_SHAPE); }
 
+    inline bool matchesGetterSetter(PropertyOp rawGetter,
+                                    StrictPropertyOp rawSetter) const;
+
     inline void adoptUnowned(UnownedBaseShape *other);
     inline void setOwned(UnownedBaseShape *unowned);
 
diff --git a/js/src/jsscopeinlines.h b/js/src/jsscopeinlines.h
index e8a1e2d588e6..b3aae3eafeea 100644
--- a/js/src/jsscopeinlines.h
+++ b/js/src/jsscopeinlines.h
@@ -108,6 +108,12 @@ BaseShape::BaseShape(Class *clasp, JSObject *parent, uint32 objectFlags,
         flags |= HAS_SETTER_OBJECT;
 }
 
+inline bool
+BaseShape::matchesGetterSetter(PropertyOp rawGetter, StrictPropertyOp rawSetter) const
+{
+    return rawGetter == this->rawGetter && rawSetter == this->rawSetter;
+}
+
 inline void
 BaseShape::setParent(JSObject *obj)
 {