Revert 782a44082ed2, which was a somewhat-too-optimistic removal of code that's not dead yet (and is not getting better). r=orange

js/src/jsinterp.cpp

@@ -4288,13 +4288,13 @@ BEGIN_CASE(JSOP_SETMETHOD)
         JSAtom *atom;
         if (cache->testForSet(cx, regs.pc, obj, &entry, &obj2, &atom)) {
             /*
-             * Property cache hit, only partially confirmed by testForSet. We
-             * know that the entry applies to regs.pc and that obj's shape
-             * matches.
+             * Fast property cache hit, only partially confirmed by
+             * testForSet. We know that the entry applies to regs.pc and
+             * that obj's shape matches.
              *
-             * The entry predicts either a new property to be added directly to
-             * obj by this set, or on an existing "own" property, or on a
-             * prototype property that has a setter.
+             * The entry predicts either a new property to be added
+             * directly to obj by this set, or on an existing "own"
+             * property, or on a prototype property that has a setter.
              */
             const Shape *shape = entry->vword.toShape();
             JS_ASSERT_IF(shape->isDataDescriptor(), shape->writable());
@@ -4385,12 +4385,26 @@ BEGIN_CASE(JSOP_SETMETHOD)
                 }
             }
             PCMETER(cache->setpcmisses++);
-
-            LOAD_ATOM(0, atom);
-        } else {
-            JS_ASSERT(atom);
+            atom = NULL;
+        } else if (!atom) {
+            /*
+             * Slower property cache hit, fully confirmed by testForSet (in the
+             * slow path, via fullTest).
+             */
+            ASSERT_VALID_PROPERTY_CACHE_HIT(0, obj, obj2, entry);
+            const Shape *shape = NULL;
+            if (obj == obj2) {
+                shape = entry->vword.toShape();
+                JS_ASSERT(shape->writable());
+                JS_ASSERT(obj2->isExtensible());
+                NATIVE_SET(cx, obj, shape, entry, &rval);
+            }
+            if (shape)
+                break;
         }
 
+        if (!atom)
+            LOAD_ATOM(0, atom);
         jsid id = ATOM_TO_JSID(atom);
         if (entry && JS_LIKELY(!obj->getOps()->setProperty)) {
             uintN defineHow;

js/src/jspropertycache.h

@@ -236,7 +236,11 @@ class PropertyCache
     /*
      * Test for cached information about a property set on *objp at pc.
      *
-     * On a hit, set *entryp to the entry and return true.
+     * On a fast hit, set *entryp to the entry and return true.
+     *
+     * On a slow hit, set *entryp to the entry, set *obj2p to the object that
+     * owns the property (either obj or a prototype), set *atomp to NULL, and
+     * return false.
      *
      * On a miss, set *atomp to the name of the property being set and return false.
      */

js/src/jspropertycacheinlines.h

@@ -115,12 +115,16 @@ PropertyCache::testForSet(JSContext *cx, jsbytecode *pc, JSObject *obj,
     if (entry->kpc == pc && entry->kshape == shape && CX_OWNS_OBJECT_TITLE(cx, obj))
         return true;
 
+#ifdef DEBUG
+    JSObject *orig = obj;
+#endif
     JSAtom *atom = fullTest(cx, pc, &obj, obj2p, entry);
-    JS_ASSERT(atom);
-
-    PCMETER(misses++);
-    PCMETER(setmisses++);
-
+    if (atom) {
+        PCMETER(misses++);
+        PCMETER(setmisses++);
+    } else {
+        JS_ASSERT(obj == orig);
+    }
     *atomp = atom;
     return false;
 }

js/src/methodjit/StubCalls.cpp

@@ -144,13 +144,13 @@ stubs::SetName(VMFrame &f, JSAtom *origAtom)
         JSAtom *atom;
         if (cache->testForSet(cx, f.regs.pc, obj, &entry, &obj2, &atom)) {
             /*
-             * Property cache hit, only partially confirmed by testForSet. We
-             * know that the entry applies to regs.pc and that obj's shape
-             * matches.
+             * Fast property cache hit, only partially confirmed by
+             * testForSet. We know that the entry applies to regs.pc and
+             * that obj's shape matches.
              *
-             * The entry predicts either a new property to be added directly to
-             * obj by this set, or on an existing "own" property, or on a
-             * prototype property that has a setter.
+             * The entry predicts either a new property to be added
+             * directly to obj by this set, or on an existing "own"
+             * property, or on a prototype property that has a setter.
              */
             const Shape *shape = entry->vword.toShape();
             JS_ASSERT_IF(shape->isDataDescriptor(), shape->writable());
@@ -240,12 +240,25 @@ stubs::SetName(VMFrame &f, JSAtom *origAtom)
                 }
             }
             PCMETER(cache->setpcmisses++);
-
-            atom = origAtom;
-        } else {
-            JS_ASSERT(atom);
+            atom = NULL;
+        } else if (!atom) {
+            /*
+             * Slower property cache hit, fully confirmed by testForSet (in the
+             * slow path, via fullTest).
+             */
+            const Shape *shape = NULL;
+            if (obj == obj2) {
+                shape = entry->vword.toShape();
+                JS_ASSERT(shape->writable());
+                JS_ASSERT(obj2->isExtensible());
+                NATIVE_SET(cx, obj, shape, entry, &rval);
+            }
+            if (shape)
+                break;
         }
 
+        if (!atom)
+            atom = origAtom;
         jsid id = ATOM_TO_JSID(atom);
         if (entry && JS_LIKELY(!obj->getOps()->setProperty)) {
             uintN defineHow;