Bug 899139 - Part 3: Install SetElementIC for typed array writes. (r=bhackett)

js/src/jit/BaselineInspector.cpp

@@ -59,6 +59,20 @@ SetElemICInspector::sawDenseWrite() const
     return false;
 }
 
+bool
+SetElemICInspector::sawTypedArrayWrite() const
+{
+    if (!icEntry_)
+        return false;
+
+    // Check for a SetElem_TypedArray stub.
+    for (ICStub *stub = icEntry_->firstStub(); stub; stub = stub->next()) {
+        if (stub->isSetElem_TypedArray())
+            return true;
+    }
+    return false;
+}
+
 bool
 BaselineInspector::maybeShapesForPropertyOp(jsbytecode *pc, Vector<Shape *> &shapes)
 {

js/src/jit/BaselineInspector.h

@@ -40,6 +40,7 @@ class SetElemICInspector : public ICInspector
     bool sawOOBDenseWrite() const;
     bool sawOOBTypedArrayWrite() const;
     bool sawDenseWrite() const;
+    bool sawTypedArrayWrite() const;
 };
 
 class BaselineInspector

js/src/jit/IonBuilder.cpp

@@ -7264,9 +7264,9 @@ IonBuilder::setElemTryCache(bool *emitted, MDefinition *object,
 
     // TODO: Bug 876650: remove this check:
     // Temporary disable the cache if non dense native,
-    // untill the cache supports more ics
+    // until the cache supports more ics
     SetElemICInspector icInspect(inspector->setElemICInspector(pc));
-    if (!icInspect.sawDenseWrite())
+    if (!icInspect.sawDenseWrite() && !icInspect.sawTypedArrayWrite())
         return true;
 
     bool needsBarrier;

js/src/jit/IonCaches.cpp

@@ -3367,12 +3367,10 @@ SetElementIC::attachDenseElement(JSContext *cx, IonScript *ion, JSObject *obj, c
 
 static bool
 GenerateSetTypedArrayElement(JSContext *cx, MacroAssembler &masm, IonCache::StubAttacher &attacher,
-                             TypedArrayObject *tarr, const Value &idval, Register object,
+                             TypedArrayObject *tarr, Register object,
                              ValueOperand indexVal, ConstantOrRegister value,
                              Register tempUnbox, Register temp, FloatRegister tempFloat)
 {
-    JS_ASSERT(SetElementIC::canAttachTypedArrayElement(tarr, idval));
-
     Label failures, done, popObjectAndFail;
 
     // Guard on the shape.
@@ -3444,18 +3442,19 @@ GenerateSetTypedArrayElement(JSContext *cx, MacroAssembler &masm, IonCache::Stub
 }
 
 /* static */ bool
-SetElementIC::canAttachTypedArrayElement(JSObject *obj, const Value &idval)
+SetElementIC::canAttachTypedArrayElement(JSObject *obj, const Value &idval, const Value &value)
 {
-    return obj->is<TypedArrayObject>() && idval.isInt32();
+    // Don't bother attaching stubs for assigning strings and objects.
+    return (obj->is<TypedArrayObject>() && idval.isInt32() &&
+            !value.isString() && !value.isObject());
 }
 
 bool
-SetElementIC::attachTypedArrayElement(JSContext *cx, IonScript *ion,
-                                      TypedArrayObject *tarr, const Value &idval)
+SetElementIC::attachTypedArrayElement(JSContext *cx, IonScript *ion, TypedArrayObject *tarr)
 {
     MacroAssembler masm(cx);
     RepatchStubAppender attacher(*this);
-    if (!GenerateSetTypedArrayElement(cx, masm, attacher, tarr, idval,
+    if (!GenerateSetTypedArrayElement(cx, masm, attacher, tarr,
                                       object(), index(), value(),
                                       tempToUnboxIndex(), temp(), tempFloat()))
     {
@@ -3479,9 +3478,9 @@ SetElementIC::update(JSContext *cx, size_t cacheIndex, HandleObject obj,
                 return false;
             attachedStub = true;
         }
-        if (!attachedStub && canAttachTypedArrayElement(obj, idval)) {
+        if (!attachedStub && canAttachTypedArrayElement(obj, idval, value)) {
             TypedArrayObject *tarr = &obj->as<TypedArrayObject>();
-            if (!cache.attachTypedArrayElement(cx, ion, tarr, idval))
+            if (!cache.attachTypedArrayElement(cx, ion, tarr))
                 return false;
         }
     }

js/src/jit/IonCaches.h

@@ -849,11 +849,10 @@ class SetElementIC : public RepatchIonCache
         hasDenseStub_ = true;
     }
 
-    static bool canAttachTypedArrayElement(JSObject *obj, const Value &idval);
+    static bool canAttachTypedArrayElement(JSObject *obj, const Value &idval, const Value &value);
 
     bool attachDenseElement(JSContext *cx, IonScript *ion, JSObject *obj, const Value &idval);
-    bool attachTypedArrayElement(JSContext *cx, IonScript *ion, TypedArrayObject *tarr,
-                                 const Value &idval);
+    bool attachTypedArrayElement(JSContext *cx, IonScript *ion, TypedArrayObject *tarr);
 
     static bool
     update(JSContext *cx, size_t cacheIndex, HandleObject obj, HandleValue idval,

js/src/jit/MIR.cpp

@@ -3012,6 +3012,11 @@ jit::PropertyWriteNeedsTypeBarrier(JSContext *cx, MBasicBlock *current, MDefinit
         if (!object || object->unknownProperties())
             continue;
 
+        // TI doesn't track TypedArray objects and should never insert a type
+        // barrier for them.
+        if (object->getTypedArrayType() < ScalarTypeRepresentation::TYPE_MAX)
+            continue;
+
         types::HeapTypeSet *property = object->getProperty(cx, id, false);
         if (!property) {
             success = false;
@@ -3051,6 +3056,8 @@ jit::PropertyWriteNeedsTypeBarrier(JSContext *cx, MBasicBlock *current, MDefinit
 
         if (!object || object->unknownProperties())
             continue;
+        if (object->getTypedArrayType() < ScalarTypeRepresentation::TYPE_MAX)
+            continue;
 
         types::HeapTypeSet *property = object->getProperty(cx, id, false);
         if (!property) {

js/src/jsinfer.h

@@ -1109,6 +1109,9 @@ struct TypeObject : gc::Cell
     inline unsigned getPropertyCount();
     inline Property *getProperty(unsigned i);
 
+    /* Get the typed array element type if clasp is a typed array. */
+    inline int getTypedArrayType();
+
     /*
      * Get the global object which all objects of this type are parented to,
      * or NULL if there is none known.

js/src/jsinferinlines.h

@@ -1562,6 +1562,14 @@ TypeObject::getProperty(unsigned i)
     return propertySet[i];
 }
 
+inline int
+TypeObject::getTypedArrayType()
+{
+    if (IsTypedArrayClass(clasp))
+        return clasp - &TypedArrayObject::classes[0];
+    return ScalarTypeRepresentation::TYPE_MAX;
+}
+
 inline void
 TypeObject::writeBarrierPre(TypeObject *type)
 {