[INFER] Check for constant integer objects when hoisting array and property accesses, bug 671814.

js/src/jit-test/tests/jaeger/loops/bug671814.js

@@ -0,0 +1,12 @@
+var ta = Int8Array([]);
+function Int8Array(summary) {
+    summary.length;
+}
+function test() {
+    ctors = [ Int8Array ]
+    for (var i = 0; i < 10; i++) {
+        ctor = ctors[0]
+        b = ctor(0)
+    }
+}
+test();

js/src/jsinfer.h

@@ -287,7 +287,7 @@ enum {
 
     /* If the property is definite, mask and shift storing the slot. */
     TYPE_FLAG_DEFINITE_MASK       = 0x0f000000,
-    TYPE_FLAG_DEFINITE_SHIFT      = 24,
+    TYPE_FLAG_DEFINITE_SHIFT      = 24
 };
 typedef uint32 TypeFlags;
 

js/src/methodjit/Compiler.cpp

@@ -4111,6 +4111,14 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
         return true;
     }
 
+    /* If the incoming type will never PIC, take slow path. */
+    if (top->isNotType(JSVAL_TYPE_OBJECT)) {
+        jsop_getprop_slow(atom, usePropCache);
+        return true;
+    }
+
+    frame.forgetMismatchedObject(top);
+
     if (JSOp(*PC) == JSOP_LENGTH && cx->typeInferenceEnabled() &&
         !hasTypeBarriers(PC) && knownPushedType(0) == JSVAL_TYPE_INT32) {
         /* Check if this is an array we can make a loop invariant entry for. */
@@ -4182,14 +4190,6 @@ mjit::Compiler::jsop_getprop(JSAtom *atom, JSValueType knownType,
         }
     }
 
-    /* If the incoming type will never PIC, take slow path. */
-    if (top->isNotType(JSVAL_TYPE_OBJECT)) {
-        jsop_getprop_slow(atom, usePropCache);
-        return true;
-    }
-
-    frame.forgetMismatchedObject(top);
-
     /* Check if this is a property access we can make a loop invariant entry for. */
     if (loop && loop->generatingInvariants() && !hasTypeBarriers(PC)) {
         CrossSSAValue topv(a->inlineIndex, analysis->poppedValue(PC, 0));

js/src/methodjit/LoopState.cpp

@@ -522,7 +522,7 @@ LoopState::hoistArrayLengthCheck(const CrossSSAValue &obj, const CrossSSAValue &
 
     uint32 objSlot;
     int32 objConstant;
-    if (!getEntryValue(obj, &objSlot, &objConstant) || objConstant != 0)
+    if (!getEntryValue(obj, &objSlot, &objConstant) || objSlot == UNASSIGNED || objConstant != 0)
         return false;
 
     JaegerSpew(JSpew_Analysis, "Trying to hoist bounds check on %s\n",
@@ -733,7 +733,7 @@ LoopState::invariantArraySlots(const CrossSSAValue &obj)
 
     uint32 objSlot;
     int32 objConstant;
-    if (!getEntryValue(obj, &objSlot, &objConstant) || objConstant != 0) {
+    if (!getEntryValue(obj, &objSlot, &objConstant) || objSlot == UNASSIGNED || objConstant != 0) {
         JS_NOT_REACHED("Bad value");
         return NULL;
     }
@@ -786,7 +786,7 @@ LoopState::invariantLength(const CrossSSAValue &obj)
 
     uint32 objSlot;
     int32 objConstant;
-    if (!getEntryValue(obj, &objSlot, &objConstant) || objConstant != 0)
+    if (!getEntryValue(obj, &objSlot, &objConstant) || objSlot == UNASSIGNED || objConstant != 0)
         return NULL;
     TypeSet *objTypes = ssa->getValueTypes(obj);
 
@@ -873,7 +873,7 @@ LoopState::invariantProperty(const CrossSSAValue &obj, jsid id)
 
     uint32 objSlot;
     int32 objConstant;
-    if (!getEntryValue(obj, &objSlot, &objConstant) || objConstant != 0)
+    if (!getEntryValue(obj, &objSlot, &objConstant) || objSlot == UNASSIGNED || objConstant != 0)
         return NULL;
 
     for (unsigned i = 0; i < invariantEntries.length(); i++) {
@@ -1646,7 +1646,7 @@ LoopState::definiteArrayAccess(const SSAValue &obj, const SSAValue &index)
     uint32 objSlot;
     int32 objConstant;
     CrossSSAValue objv(CrossScriptSSA::OUTER_FRAME, obj);
-    if (!getEntryValue(objv, &objSlot, &objConstant) || objConstant != 0)
+    if (!getEntryValue(objv, &objSlot, &objConstant) || objSlot == UNASSIGNED || objConstant != 0)
         return false;
     if (!loopInvariantEntry(objSlot))
         return false;