From 3e4cdf84d6aa21e7135efd134cee986489fd1afe Mon Sep 17 00:00:00 2001
From: Brendan Eich <brendan@mozilla.org>
Date: Mon, 11 Aug 2008 00:05:39 -0700
Subject: [PATCH] - Skip dense array object, try prototype, in all
 JSOP_GET*PROP variants, interpreter and tracer. - Test entry instead of
 retesting aobj->map->ops->getProperty == js_GetProperty in JSOP_CALLPROP. -
 Handle object and null types as well as booleans in record_JSOP_NOT. -
 Trivially implement JSOP_STRICT{EQ,NE} recording by forwarding to the
 non-strict record methods. This works so long as the latter trace only
 same-type operands and do no conversions.

---
 js/src/jsinterp.cpp | 12 +++++++-----
 js/src/jstracer.cpp |  8 ++++----
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index cf965929f3eb..e438fa7749c3 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -4169,12 +4169,14 @@ js_Interpret(JSContext *cx)
 
           do_getprop_with_obj:
             do {
+                JSObject *aobj;
                 JSPropCacheEntry *entry;
 
-                if (JS_LIKELY(obj->map->ops->getProperty == js_GetProperty)) {
-                    PROPERTY_CACHE_TEST(cx, regs.pc, obj, obj2, entry, atom);
+                aobj = OBJ_IS_DENSE_ARRAY(cx, obj) ? OBJ_GET_PROTO(cx, obj) : obj;
+                if (JS_LIKELY(aobj->map->ops->getProperty == js_GetProperty)) {
+                    PROPERTY_CACHE_TEST(cx, regs.pc, aobj, obj2, entry, atom);
                     if (!atom) {
-                        ASSERT_VALID_PROPERTY_CACHE_HIT(i, obj, obj2, entry);
+                        ASSERT_VALID_PROPERTY_CACHE_HIT(0, aobj, obj2, entry);
                         if (PCVAL_IS_OBJECT(entry->vword)) {
                             rval = PCVAL_OBJECT_TO_JSVAL(entry->vword);
                         } else if (PCVAL_IS_SLOT(entry->vword)) {
@@ -4198,7 +4200,7 @@ js_Interpret(JSContext *cx)
                 }
                 id = ATOM_TO_JSID(atom);
                 if (entry
-                    ? !js_GetPropertyHelper(cx, obj, id, &rval, &entry)
+                    ? !js_GetPropertyHelper(cx, aobj, id, &rval, &entry)
                     : !OBJ_GET_PROPERTY(cx, obj, id, &rval)) {
                     goto error;
                 }
@@ -4305,7 +4307,7 @@ js_Interpret(JSContext *cx)
                         goto error;
                 } else
 #endif
-                if (JS_LIKELY(aobj->map->ops->getProperty == js_GetProperty)
+                if (entry
                     ? !js_GetPropertyHelper(cx, aobj, id, &rval, &entry)
                     : !OBJ_GET_PROPERTY(cx, obj, id, &rval)) {
                     goto error;
diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp
index 388322d95954..b5cae5c5e901 100644
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -2118,7 +2118,7 @@ TraceRecorder::test_property_cache(JSObject* obj, LIns* obj_ins, JSObject*& obj2
     // Mimic JSOP_CALLPROP's special case to skip up from a dense array to find
     // Array.prootype methods.
     JSObject* aobj = obj;
-    if (JSOp(*cx->fp->regs->pc) == JSOP_CALLPROP && OBJ_IS_DENSE_ARRAY(cx, obj)) {
+    if (OBJ_IS_DENSE_ARRAY(cx, obj)) {
         aobj = OBJ_GET_PROTO(cx, obj);
         obj_ins = stobj_get_fslot(obj_ins, JSSLOT_PROTO);
     }
@@ -2761,7 +2761,7 @@ bool
 TraceRecorder::record_JSOP_NOT()
 {
     jsval& v = stackval(-1);
-    if (JSVAL_IS_BOOLEAN(v)) {
+    if (JSVAL_IS_BOOLEAN(v) || JSVAL_IS_OBJECT(v)) {
         set(&v, lir->ins_eq0(get(&v)));
         return true;
     }
@@ -3588,13 +3588,13 @@ TraceRecorder::record_JSOP_LOOKUPSWITCH()
 bool
 TraceRecorder::record_JSOP_STRICTEQ()
 {
-    return false;
+    return record_JSOP_EQ();
 }
 
 bool
 TraceRecorder::record_JSOP_STRICTNE()
 {
-    return false;
+    return record_JSOP_NE();
 }
 
 bool