Bug 607242 - TM: inline js_Array_dense_setelem_hole. r=gal.

js/src/jsarray.cpp

@@ -813,24 +813,6 @@ js_PrototypeHasIndexedProperties(JSContext *cx, JSObject *obj)
     return JS_FALSE;
 }
 
-#ifdef JS_TRACER
-
-JSBool FASTCALL
-js_Array_dense_setelem_hole(JSContext* cx, JSObject* obj, jsint i)
-{
-    if (js_PrototypeHasIndexedProperties(cx, obj))
-        return false;
-
-    jsuint u = jsuint(i);
-    if (u >= obj->getArrayLength())
-        obj->setArrayLength(u + 1);
-    return true;
-}
-/* storeAccSet == ACCSET_OBJ_PRIVATE: because it can set 'length'. */
-JS_DEFINE_CALLINFO_3(extern, BOOL, js_Array_dense_setelem_hole, CONTEXT, OBJECT, INT32,
-                     0, tjit::ACCSET_OBJ_PRIVATE)
-#endif
-
 static JSBool
 array_defineProperty(JSContext *cx, JSObject *obj, jsid id, const Value *value,
                      PropertyOp getter, PropertyOp setter, uintN attrs)

js/src/jsbuiltins.h

@@ -575,7 +575,6 @@ js_dmod(jsdouble a, jsdouble b);
 #endif /* !JS_TRACER */
 
 /* Defined in jsarray.cpp. */
-JS_DECLARE_CALLINFO(js_Array_dense_setelem_hole)
 JS_DECLARE_CALLINFO(js_NewEmptyArray)
 JS_DECLARE_CALLINFO(js_NewPreallocatedArray)
 JS_DECLARE_CALLINFO(js_InitializerArray)

js/src/jstracer.cpp

@@ -12798,12 +12798,15 @@ TraceRecorder::setElem(int lval_spindex, int idx_spindex, int v_spindex)
 #endif
                                  w.nameImmui(JSVAL_TAG_MAGIC));
         w.pauseAddingCSEValues();
-        if (MaybeBranch mbr = w.jf(isHole_ins)) {
-            LIns* args[] = { idx_ins, obj_ins, cx_ins };
-            LIns* res_ins = w.name(w.call(&js_Array_dense_setelem_hole_ci, args),
-                                    "hasNoIndexedProperties");
-            guard(false, w.eqi0(res_ins), mismatchExit);
-            w.label(mbr);
+        if (MaybeBranch mbr1 = w.jf(isHole_ins)) {
+            CHECK_STATUS_A(guardPrototypeHasNoIndexedProperties(obj, obj_ins, mismatchExit));
+            LIns* length_ins = w.lduiObjPrivate(obj_ins);
+            if (MaybeBranch mbr2 = w.jt(w.ltui(idx_ins, length_ins))) {
+                LIns* newLength_ins = w.name(w.addiN(idx_ins, 1), "newLength");
+                w.stuiObjPrivate(obj_ins, newLength_ins);
+                w.label(mbr2);
+            }
+            w.label(mbr1);
         }
         w.resumeAddingCSEValues();
 

js/src/tracejit/Writer.cpp

@@ -403,8 +403,9 @@ void ValidateWriter::checkAccSet(LOpcode op, LIns *base, int32_t disp, AccSet ac
 
       case ACCSET_OBJ_PRIVATE:
         // base = <JSObject>
-        // ins  = ldp.objprivate base[offsetof(JSObject, privateData)]
-        ok = (op == LIR_ldi || op == LIR_ldp) &&
+        // ins  = {ld,st}p.objprivate base[offsetof(JSObject, privateData)]
+        ok = (op == LIR_ldi || op == LIR_ldp ||
+              op == LIR_sti || op == LIR_stp) &&
              disp == offsetof(JSObject, privateData) &&
              couldBeObjectOrString(base);
         break;

js/src/tracejit/Writer.h

@@ -490,6 +490,12 @@ class Writer
                     "private_uint32");
     }
 
+    nj::LIns *stuiObjPrivate(nj::LIns *obj, nj::LIns *value) const {
+        return name(lir->insStore(nj::LIR_sti, value, obj, offsetof(JSObject, privateData),
+                                  ACCSET_OBJ_PRIVATE),
+                    "private_uint32");
+    }
+
     nj::LIns *ldiDenseArrayCapacity(nj::LIns *array) const {
         return name(lir->insLoad(nj::LIR_ldi, array, offsetof(JSObject, capacity),
                                  ACCSET_OBJ_CAPACITY),
@@ -938,6 +944,10 @@ class Writer
         return lir->ins2(nj::LIR_addi, x, y);
     }
 
+    nj::LIns *addiN(nj::LIns *x, int32 imm) const {
+        return lir->ins2ImmI(nj::LIR_addi, x, imm);
+    }
+
     nj::LIns *subi(nj::LIns *x, nj::LIns *y) const {
         return lir->ins2(nj::LIR_subi, x, y);
     }