Bug 851769 part 2 - Fast path Array.prototype.reverse when no pre-barriers are needed. r=anba

--HG--
extra : rebase_source : 4330eebdf397ffe43b40887b767c225a9aea0660

js/src/jsarray.cpp

@@ -1556,6 +1556,11 @@ ArrayReverseDenseKernel(JSContext* cx, HandleNativeObject obj, uint32_t length)
             return DenseElementResult::Failure;
     }
 
+    if (!MaybeInIteration(obj, cx) && !cx->zone()->needsIncrementalBarrier()) {
+        obj->reverseDenseElementsNoPreBarrier(length);
+        return DenseElementResult::Success;
+    }
+
     RootedValue origlo(cx), orighi(cx);
 
     uint32_t lo = 0, hi = length - 1;

js/src/vm/NativeObject-inl.h

@@ -279,6 +279,32 @@ NativeObject::moveDenseElementsNoPreBarrier(uint32_t dstStart, uint32_t srcStart
     elementsRangeWriteBarrierPost(dstStart, count);
 }
 
+inline void
+NativeObject::reverseDenseElementsNoPreBarrier(uint32_t length)
+{
+    MOZ_ASSERT(!shadowZone()->needsIncrementalBarrier());
+
+    MOZ_ASSERT(!denseElementsAreCopyOnWrite());
+    MOZ_ASSERT(!denseElementsAreFrozen());
+
+    MOZ_ASSERT(length > 1);
+    MOZ_ASSERT(length <= getDenseInitializedLength());
+
+    Value* valLo = reinterpret_cast<Value*>(elements_);
+    Value* valHi = valLo + (length - 1);
+    MOZ_ASSERT(valLo < valHi);
+
+    do {
+        Value origLo = *valLo;
+        *valLo = *valHi;
+        *valHi = origLo;
+        ++valLo;
+        --valHi;
+    } while (valLo < valHi);
+
+    elementsRangeWriteBarrierPost(0, length);
+}
+
 inline void
 NativeObject::ensureDenseInitializedLengthNoPackedCheck(uint32_t index, uint32_t extra)
 {

js/src/vm/NativeObject.h

@@ -1246,6 +1246,7 @@ class NativeObject : public ShapedObject
     inline void initDenseElements(NativeObject* src, uint32_t srcStart, uint32_t count);
     inline void moveDenseElements(uint32_t dstStart, uint32_t srcStart, uint32_t count);
     inline void moveDenseElementsNoPreBarrier(uint32_t dstStart, uint32_t srcStart, uint32_t count);
+    inline void reverseDenseElementsNoPreBarrier(uint32_t length);
 
     inline DenseElementResult
     setOrExtendDenseElements(JSContext* cx, uint32_t start, const Value* vp, uint32_t count,