- Skip dense array object, try prototype, in all JSOP_GET*PROP variants, interpreter and tracer.

- Test entry instead of retesting aobj->map->ops->getProperty == js_GetProperty in JSOP_CALLPROP.
- Handle object and null types as well as booleans in record_JSOP_NOT.
- Trivially implement JSOP_STRICT{EQ,NE} recording by forwarding to the non-strict record methods. This works so long as the latter trace only same-type operands and do no conversions.

js/src/jsinterp.cpp

@@ -4169,12 +4169,14 @@ js_Interpret(JSContext *cx)
 
           do_getprop_with_obj:
             do {
+                JSObject *aobj;
                 JSPropCacheEntry *entry;
 
-                if (JS_LIKELY(obj->map->ops->getProperty == js_GetProperty)) {
-                    PROPERTY_CACHE_TEST(cx, regs.pc, obj, obj2, entry, atom);
+                aobj = OBJ_IS_DENSE_ARRAY(cx, obj) ? OBJ_GET_PROTO(cx, obj) : obj;
+                if (JS_LIKELY(aobj->map->ops->getProperty == js_GetProperty)) {
+                    PROPERTY_CACHE_TEST(cx, regs.pc, aobj, obj2, entry, atom);
                     if (!atom) {
-                        ASSERT_VALID_PROPERTY_CACHE_HIT(i, obj, obj2, entry);
+                        ASSERT_VALID_PROPERTY_CACHE_HIT(0, aobj, obj2, entry);
                         if (PCVAL_IS_OBJECT(entry->vword)) {
                             rval = PCVAL_OBJECT_TO_JSVAL(entry->vword);
                         } else if (PCVAL_IS_SLOT(entry->vword)) {
@@ -4198,7 +4200,7 @@ js_Interpret(JSContext *cx)
                 }
                 id = ATOM_TO_JSID(atom);
                 if (entry
-                    ? !js_GetPropertyHelper(cx, obj, id, &rval, &entry)
+                    ? !js_GetPropertyHelper(cx, aobj, id, &rval, &entry)
                     : !OBJ_GET_PROPERTY(cx, obj, id, &rval)) {
                     goto error;
                 }
@@ -4305,7 +4307,7 @@ js_Interpret(JSContext *cx)
                         goto error;
                 } else
 #endif
-                if (JS_LIKELY(aobj->map->ops->getProperty == js_GetProperty)
+                if (entry
                     ? !js_GetPropertyHelper(cx, aobj, id, &rval, &entry)
                     : !OBJ_GET_PROPERTY(cx, obj, id, &rval)) {
                     goto error;

js/src/jstracer.cpp

@@ -2118,7 +2118,7 @@ TraceRecorder::test_property_cache(JSObject* obj, LIns* obj_ins, JSObject*& obj2
     // Mimic JSOP_CALLPROP's special case to skip up from a dense array to find
     // Array.prootype methods.
     JSObject* aobj = obj;
-    if (JSOp(*cx->fp->regs->pc) == JSOP_CALLPROP && OBJ_IS_DENSE_ARRAY(cx, obj)) {
+    if (OBJ_IS_DENSE_ARRAY(cx, obj)) {
         aobj = OBJ_GET_PROTO(cx, obj);
         obj_ins = stobj_get_fslot(obj_ins, JSSLOT_PROTO);
     }
@@ -2761,7 +2761,7 @@ bool
 TraceRecorder::record_JSOP_NOT()
 {
     jsval& v = stackval(-1);
-    if (JSVAL_IS_BOOLEAN(v)) {
+    if (JSVAL_IS_BOOLEAN(v) || JSVAL_IS_OBJECT(v)) {
         set(&v, lir->ins_eq0(get(&v)));
         return true;
     }
@@ -3588,13 +3588,13 @@ TraceRecorder::record_JSOP_LOOKUPSWITCH()
 bool
 TraceRecorder::record_JSOP_STRICTEQ()
 {
-    return false;
+    return record_JSOP_EQ();
 }
 
 bool
 TraceRecorder::record_JSOP_STRICTNE()
 {
-    return false;
+    return record_JSOP_NE();
 }
 
 bool