Bug 1364346 part 1 - Optimize Array.prototype.unshift fast path and use it more. r=anba

js/src/jsarray.cpp

@@ -2485,41 +2485,41 @@ js::array_unshift(JSContext* cx, unsigned argc, Value* vp)
 
     // Steps 3-4.
     if (args.length() > 0) {
-        /* Slide up the array to make room for all args at the bottom. */
-        if (length > 0) {
-            // Only include a fast path for boxed arrays. Unboxed arrays can't
-            // be optimized here because unshifting temporarily places holes at
-            // the start of the array.
-            // TODO: Implement unboxed array optimization similar to the one in
-            // array_splice_impl(), unshift() is a special version of splice():
-            // arr.unshift(...values) ~= arr.splice(0, 0, ...values).
-            bool optimized = false;
-            do {
-                if (length > UINT32_MAX)
-                    break;
-                if (!obj->is<ArrayObject>())
-                    break;
-                if (ObjectMayHaveExtraIndexedProperties(obj))
-                    break;
-                if (MaybeInIteration(obj, cx))
-                    break;
-                ArrayObject* aobj = &obj->as<ArrayObject>();
-                if (!aobj->lengthIsWritable())
-                    break;
-                DenseElementResult result = aobj->ensureDenseElements(cx, uint32_t(length), args.length());
-                if (result != DenseElementResult::Success) {
-                    if (result == DenseElementResult::Failure)
-                        return false;
-                    MOZ_ASSERT(result == DenseElementResult::Incomplete);
-                    break;
-                }
-                aobj->moveDenseElements(args.length(), 0, uint32_t(length));
-                for (uint32_t i = 0; i < args.length(); i++)
-                    aobj->setDenseElement(i, MagicValue(JS_ELEMENTS_HOLE));
-                optimized = true;
-            } while (false);
+        // Only include a fast path for native objects. Unboxed arrays can't
+        // be optimized here because unshifting temporarily places holes at
+        // the start of the array.
+        // TODO: Implement unboxed array optimization similar to the one in
+        // array_splice_impl(), unshift() is a special version of splice():
+        // arr.unshift(...values) ~= arr.splice(0, 0, ...values).
+        bool optimized = false;
+        do {
+            if (length > UINT32_MAX)
+                break;
+            if (!obj->isNative())
+                break;
+            if (ObjectMayHaveExtraIndexedProperties(obj))
+                break;
+            if (MaybeInIteration(obj, cx))
+                break;
+            NativeObject* nobj = &obj->as<NativeObject>();
+            if (nobj->is<ArrayObject>() && !nobj->as<ArrayObject>().lengthIsWritable())
+                break;
+            DenseElementResult result = nobj->ensureDenseElements(cx, uint32_t(length), args.length());
+            if (result != DenseElementResult::Success) {
+                if (result == DenseElementResult::Failure)
+                    return false;
+                MOZ_ASSERT(result == DenseElementResult::Incomplete);
+                break;
+            }
+            if (length > 0)
+                nobj->moveDenseElements(args.length(), 0, uint32_t(length));
+            for (uint32_t i = 0; i < args.length(); i++)
+                nobj->setDenseElementWithType(cx, i, args[i]);
+            optimized = true;
+        } while (false);
 
-            if (!optimized) {
+        if (!optimized) {
+            if (length > 0) {
                 uint64_t last = length;
                 uint64_t upperIndex = last + args.length();
 
@@ -2547,12 +2547,12 @@ js::array_unshift(JSContext* cx, unsigned argc, Value* vp)
                     }
                 } while (last != 0);
             }
-        }
 
-        // Steps 4.d-f.
-        /* Copy from args to the bottom of the array. */
-        if (!SetArrayElements(cx, obj, 0, args.length(), args.array()))
-            return false;
+            // Steps 4.d-f.
+            /* Copy from args to the bottom of the array. */
+            if (!SetArrayElements(cx, obj, 0, args.length(), args.array()))
+                return false;
+        }
     }
 
     // Step 5.