mozilla
/
gecko-dev
зеркало из https://github.com/mozilla/gecko-dev.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Bug 822340. Disable the Ion optimization for DOM method calls. r=jandem, a=bbajaj

This commit is contained in:
Boris Zbarsky 2012-12-19 19:58:32 -08:00
Родитель 5aad7419bd
Коммит fefb8bff6a
4 изменённых файлов: 21 добавлений и 69 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

11
dom/bindings/crashtests/822340-1.html Normal file
Просмотреть файл

@ -0,0 +1,11 @@
<!DOCTYPE html>
<script>
var xhr = new XMLHttpRequest;
function f() {
var x = xhr.getResponseHeader;
x("abc");
}
for (var i = 0; i < 20000; ++i) {
try { f(); } catch (e) {}
}
</script>

8
dom/bindings/crashtests/822340-2.html Normal file
Просмотреть файл

@ -0,0 +1,8 @@
<!DOCTYPE html>
<script>
var l = document.getElementsByTagName("*");
var count = 20000;
for (var i = 0; i < count; ++i) {
l.item(0);
}
</script>

2
dom/bindings/crashtests/crashtests.list
Просмотреть файл

@ -1 +1,3 @@
asserts-if(cocoaWidget,0-1) load 769464.html
load 822340-1.html
load 822340-2.html

69
js/src/ion/IonBuilder.cpp
Просмотреть файл

@ -5567,66 +5567,6 @@ TestShouldDOMCall(JSContext *cx, types::TypeSet *inTypes, HandleFunction func,
return true;
}
static bool
TestAreKnownDOMTypes(JSContext *cx, types::TypeSet *inTypes)
{
if (inTypes->unknown())
return false;
// First iterate to make sure they all are DOM objects, then freeze all of
// them as such if they are.
for (unsigned i = 0; i < inTypes->getObjectCount(); i++) {
types::TypeObject *curType = inTypes->getTypeObject(i);
if (!curType) {
JSObject *curObj = inTypes->getSingleObject(i);
// Skip holes in TypeSets.
if (!curObj)
continue;
curType = curObj->getType(cx);
}
if (curType->unknownProperties())
return false;
// Unlike TypeSet::HasObjectFlags, TypeObject::hasAnyFlags doesn't add a
// freeze.
if (curType->hasAnyFlags(types::OBJECT_FLAG_NON_DOM))
return false;
}
// If we didn't check anything, no reason to say yes.
if (inTypes->getObjectCount() > 0)
return true;
return false;
}
static void
FreezeDOMTypes(JSContext *cx, types::StackTypeSet *inTypes)
{
for (unsigned i = 0; i < inTypes->getObjectCount(); i++) {
types::TypeObject *curType = inTypes->getTypeObject(i);
if (!curType) {
JSObject *curObj = inTypes->getSingleObject(i);
// Skip holes in TypeSets.
if (!curObj)
continue;
curType = curObj->getType(cx);
}
// Add freeze by asking the question.
DebugOnly<bool> wasntDOM =
types::HeapTypeSet::HasObjectFlags(cx, curType, types::OBJECT_FLAG_NON_DOM);
JS_ASSERT(!wasntDOM);
}
}
bool
IonBuilder::annotateGetPropertyCache(JSContext *cx, MDefinition *obj, MGetPropertyCache *getPropCache,
types::StackTypeSet *objTypes, types::StackTypeSet *pushedTypes)
@ -5835,15 +5775,6 @@ IonBuilder::jsop_getprop(HandlePropertyName name)
MConstant *known = MConstant::New(ObjectValue(*singleton));
current->add(known);
current->push(known);
if (singleton->isFunction()) {
RootedFunction singletonFunc(cx, singleton->toFunction());
if (TestAreKnownDOMTypes(cx, unaryTypes.inTypes) &&
TestShouldDOMCall(cx, unaryTypes.inTypes, singletonFunc, JSJitInfo::Method))
{
FreezeDOMTypes(cx, unaryTypes.inTypes);
known->setDOMFunction();
}
}
return true;
}
}