From d594b182110ac762e116b4111ee1a4e68d95eb39 Mon Sep 17 00:00:00 2001
From: Brendan Eich <brendan@mozilla.org>
Date: Fri, 18 Jul 2008 22:53:22 -0700
Subject: [PATCH] Property-cache JSOP_NAMEINC etc. direct slot case (445893,
 r=shaver).

---
 js/src/jsemit.cpp   |  4 ++--
 js/src/jsinterp.cpp | 40 ++++++++++++++++++++++++++++++++++++++--
 2 files changed, 40 insertions(+), 4 deletions(-)

diff --git a/js/src/jsemit.cpp b/js/src/jsemit.cpp
index 329dc7ec9830..6554829f620d 100644
--- a/js/src/jsemit.cpp
+++ b/js/src/jsemit.cpp
@@ -3952,8 +3952,8 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
         if (fun->u.i.script) {
             /*
              * This second pass is needed to emit JSOP_NOP with a source note
-             * for the already-emitted function. See comments in the TOK_LC
-             * case.
+             * for the already-emitted function definition prolog opcode. See
+             * comments in the TOK_LC case.
              */
             JS_ASSERT(pn->pn_op == JSOP_NOP);
             JS_ASSERT(cg->treeContext.flags & TCF_IN_FUNCTION);
diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index 127f3ed2d86d..af4ff9010e4f 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -2536,6 +2536,11 @@ JS_STATIC_ASSERT(JSOP_DEFFUN_LENGTH == JSOP_CLOSURE_LENGTH);
 JS_STATIC_ASSERT(JSOP_IFNE_LENGTH == JSOP_IFEQ_LENGTH);
 JS_STATIC_ASSERT(JSOP_IFNE == JSOP_IFEQ + 1);
 
+/* For the fastest case inder JSOP_INCNAME, etc. */
+JS_STATIC_ASSERT(JSOP_INCNAME_LENGTH == JSOP_DECNAME_LENGTH);
+JS_STATIC_ASSERT(JSOP_INCNAME_LENGTH == JSOP_NAMEINC_LENGTH);
+JS_STATIC_ASSERT(JSOP_INCNAME_LENGTH == JSOP_NAMEDEC_LENGTH);
+
 JSBool
 js_Interpret(JSContext *cx)
 {
@@ -3985,13 +3990,44 @@ js_Interpret(JSContext *cx)
           BEGIN_CASE(JSOP_DECNAME)
           BEGIN_CASE(JSOP_NAMEINC)
           BEGIN_CASE(JSOP_NAMEDEC)
-            LOAD_ATOM(0);
+          {
+            JSPropCacheEntry *entry;
+
+            obj = fp->scopeChain;
+            if (JS_LIKELY(OBJ_IS_NATIVE(obj))) {
+                PROPERTY_CACHE_TEST(cx, regs.pc, obj, obj2, entry, atom);
+                if (!atom) {
+                    ASSERT_VALID_PROPERTY_CACHE_HIT(0, obj, obj2, entry);
+                    if (obj == obj2 && PCVAL_IS_SLOT(entry->vword)) {
+                        slot = PCVAL_TO_SLOT(entry->vword);
+                        JS_ASSERT(slot < obj->map->freeslot);
+                        rval = LOCKED_OBJ_GET_SLOT(obj, slot);
+                        if (JS_LIKELY(CAN_DO_FAST_INC_DEC(rval))) {
+                            rtmp = rval;
+                            rval += (js_CodeSpec[op].format & JOF_INC) ? 2 : -2;
+                            if (!(js_CodeSpec[op].format & JOF_POST))
+                                rtmp = rval;
+                            LOCKED_OBJ_SET_SLOT(obj, slot, rval);
+                            JS_UNLOCK_OBJ(cx, obj);
+                            PUSH_OPND(rtmp);
+                            len = JSOP_INCNAME_LENGTH;
+                            DO_NEXT_OP(len);
+                        }
+                    }
+                    JS_UNLOCK_OBJ(cx, obj2);
+                    LOAD_ATOM(0);
+                }
+            } else {
+                entry = NULL;
+                LOAD_ATOM(0);
+            }
             id = ATOM_TO_JSID(atom);
-            if (!js_FindProperty(cx, id, &obj, &obj2, &prop))
+            if (js_FindPropertyHelper(cx, id, &obj, &obj2, &prop, &entry) < 0)
                 goto error;
             if (!prop)
                 goto atom_not_defined;
             OBJ_DROP_PROPERTY(cx, obj2, prop);
+          }
 
           do_incop:
           {