Bug 602441 - Remove nigh-unreachable property-cache-testing code (modulo MT objects, nearing complete removal from SpiderMonkey) in the property-setting codepath. r=brendan

--HG--
extra : rebase_source : 38ed65e2dde3b80086be6da4a75120d24759df81

js/src/jsinterp.cpp

@@ -4288,13 +4288,13 @@ BEGIN_CASE(JSOP_SETMETHOD)
         JSAtom *atom;
         if (cache->testForSet(cx, regs.pc, obj, &entry, &obj2, &atom)) {
             /*
-             * Fast property cache hit, only partially confirmed by
-             * testForSet. We know that the entry applies to regs.pc and
-             * that obj's shape matches.
+             * Property cache hit, only partially confirmed by testForSet. We
+             * know that the entry applies to regs.pc and that obj's shape
+             * matches.
              *
-             * The entry predicts either a new property to be added
-             * directly to obj by this set, or on an existing "own"
-             * property, or on a prototype property that has a setter.
+             * The entry predicts either a new property to be added directly to
+             * obj by this set, or on an existing "own" property, or on a
+             * prototype property that has a setter.
              */
             const Shape *shape = entry->vword.toShape();
             JS_ASSERT_IF(shape->isDataDescriptor(), shape->writable());
@@ -4385,26 +4385,12 @@ BEGIN_CASE(JSOP_SETMETHOD)
                 }
             }
             PCMETER(cache->setpcmisses++);
-            atom = NULL;
-        } else if (!atom) {
-            /*
-             * Slower property cache hit, fully confirmed by testForSet (in the
-             * slow path, via fullTest).
-             */
-            ASSERT_VALID_PROPERTY_CACHE_HIT(0, obj, obj2, entry);
-            const Shape *shape = NULL;
-            if (obj == obj2) {
-                shape = entry->vword.toShape();
-                JS_ASSERT(shape->writable());
-                JS_ASSERT(obj2->isExtensible());
-                NATIVE_SET(cx, obj, shape, entry, &rval);
-            }
-            if (shape)
-                break;
+
+            LOAD_ATOM(0, atom);
+        } else {
+            JS_ASSERT(atom);
         }
 
-        if (!atom)
-            LOAD_ATOM(0, atom);
         jsid id = ATOM_TO_JSID(atom);
         if (entry && JS_LIKELY(!obj->getOps()->setProperty)) {
             uintN defineHow;

js/src/jspropertycache.h

@@ -236,11 +236,7 @@ class PropertyCache
     /*
      * Test for cached information about a property set on *objp at pc.
      *
-     * On a fast hit, set *entryp to the entry and return true.
-     *
-     * On a slow hit, set *entryp to the entry, set *obj2p to the object that
-     * owns the property (either obj or a prototype), set *atomp to NULL, and
-     * return false.
+     * On a hit, set *entryp to the entry and return true.
      *
      * On a miss, set *atomp to the name of the property being set and return false.
      */

js/src/jspropertycacheinlines.h

@@ -115,16 +115,12 @@ PropertyCache::testForSet(JSContext *cx, jsbytecode *pc, JSObject *obj,
     if (entry->kpc == pc && entry->kshape == shape && CX_OWNS_OBJECT_TITLE(cx, obj))
         return true;
 
-#ifdef DEBUG
-    JSObject *orig = obj;
-#endif
     JSAtom *atom = fullTest(cx, pc, &obj, obj2p, entry);
-    if (atom) {
+    JS_ASSERT(atom);
+
     PCMETER(misses++);
     PCMETER(setmisses++);
-    } else {
-        JS_ASSERT(obj == orig);
-    }
+
     *atomp = atom;
     return false;
 }

js/src/methodjit/StubCalls.cpp

@@ -144,13 +144,13 @@ stubs::SetName(VMFrame &f, JSAtom *origAtom)
         JSAtom *atom;
         if (cache->testForSet(cx, f.regs.pc, obj, &entry, &obj2, &atom)) {
             /*
-             * Fast property cache hit, only partially confirmed by
-             * testForSet. We know that the entry applies to regs.pc and
-             * that obj's shape matches.
+             * Property cache hit, only partially confirmed by testForSet. We
+             * know that the entry applies to regs.pc and that obj's shape
+             * matches.
              *
-             * The entry predicts either a new property to be added
-             * directly to obj by this set, or on an existing "own"
-             * property, or on a prototype property that has a setter.
+             * The entry predicts either a new property to be added directly to
+             * obj by this set, or on an existing "own" property, or on a
+             * prototype property that has a setter.
              */
             const Shape *shape = entry->vword.toShape();
             JS_ASSERT_IF(shape->isDataDescriptor(), shape->writable());
@@ -240,25 +240,12 @@ stubs::SetName(VMFrame &f, JSAtom *origAtom)
                 }
             }
             PCMETER(cache->setpcmisses++);
-            atom = NULL;
-        } else if (!atom) {
-            /*
-             * Slower property cache hit, fully confirmed by testForSet (in the
-             * slow path, via fullTest).
-             */
-            const Shape *shape = NULL;
-            if (obj == obj2) {
-                shape = entry->vword.toShape();
-                JS_ASSERT(shape->writable());
-                JS_ASSERT(obj2->isExtensible());
-                NATIVE_SET(cx, obj, shape, entry, &rval);
-            }
-            if (shape)
-                break;
+
+            atom = origAtom;
+        } else {
+            JS_ASSERT(atom);
         }
 
-        if (!atom)
-            atom = origAtom;
         jsid id = ATOM_TO_JSID(atom);
         if (entry && JS_LIKELY(!obj->getOps()->setProperty)) {
             uintN defineHow;