Bug 1364346 part 1 - Optimize Array.prototype.unshift fast path and use it more. r=anba

js/src/jsarray.cpp

@@ -2485,9 +2485,7 @@ js::array_unshift(JSContext* cx, unsigned argc, Value* vp)
 
     // Steps 3-4.
     if (args.length() > 0) {
-        /* Slide up the array to make room for all args at the bottom. */
+        // Only include a fast path for native objects. Unboxed arrays can't
-        if (length > 0) {
-            // Only include a fast path for boxed arrays. Unboxed arrays can't
         // be optimized here because unshifting temporarily places holes at
         // the start of the array.
         // TODO: Implement unboxed array optimization similar to the one in
@@ -2497,29 +2495,31 @@ js::array_unshift(JSContext* cx, unsigned argc, Value* vp)
         do {
             if (length > UINT32_MAX)
                 break;
-                if (!obj->is<ArrayObject>())
+            if (!obj->isNative())
                 break;
             if (ObjectMayHaveExtraIndexedProperties(obj))
                 break;
             if (MaybeInIteration(obj, cx))
                 break;
-                ArrayObject* aobj = &obj->as<ArrayObject>();
+            NativeObject* nobj = &obj->as<NativeObject>();
-                if (!aobj->lengthIsWritable())
+            if (nobj->is<ArrayObject>() && !nobj->as<ArrayObject>().lengthIsWritable())
                 break;
-                DenseElementResult result = aobj->ensureDenseElements(cx, uint32_t(length), args.length());
+            DenseElementResult result = nobj->ensureDenseElements(cx, uint32_t(length), args.length());
             if (result != DenseElementResult::Success) {
                 if (result == DenseElementResult::Failure)
                     return false;
                 MOZ_ASSERT(result == DenseElementResult::Incomplete);
                 break;
             }
-                aobj->moveDenseElements(args.length(), 0, uint32_t(length));
+            if (length > 0)
+                nobj->moveDenseElements(args.length(), 0, uint32_t(length));
             for (uint32_t i = 0; i < args.length(); i++)
-                    aobj->setDenseElement(i, MagicValue(JS_ELEMENTS_HOLE));
+                nobj->setDenseElementWithType(cx, i, args[i]);
             optimized = true;
         } while (false);
 
         if (!optimized) {
+            if (length > 0) {
                 uint64_t last = length;
                 uint64_t upperIndex = last + args.length();
 
@@ -2547,13 +2547,13 @@ js::array_unshift(JSContext* cx, unsigned argc, Value* vp)
                     }
                 } while (last != 0);
             }
-        }
 
             // Steps 4.d-f.
             /* Copy from args to the bottom of the array. */
             if (!SetArrayElements(cx, obj, 0, args.length(), args.array()))
                 return false;
         }
+    }
 
     // Step 5.
     uint64_t newlength = length + args.length();