Verified Commit 59434ea5 authored by Iain Ireland's avatar Iain Ireland Committed by ma1
Browse files

Bug 2068385: Don't support sparse arrays in SpreadMathMinMax a=pascalc 

Marking the testcase --slow because it takes 7+ minutes on my laptop in an opt-debug build.

Original Revision: https://phabricator.services.mozilla.com/D323120

Differential Revision: https://phabricator.services.mozilla.com/D324692
parent ba101997

js/src/jit/BaselineIC.cpp

+6 −1
Changes for js/src/jit/BaselineIC.cpp: 6 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -1735,10 +1735,15 @@ bool DoSpreadCallFallback(JSContext* cx, BaselineFrame* frame, 
  // Transition stub state to megamorphic or generic if warranted.

  MaybeTransition(cx, frame, stub);



  // The array is required to be packed, but may have indexed properties

  // if its length exceeds MAX_DENSE_ELEMENTS_COUNT. Don't optimize in

  // that case.

  bool isIndexed = arr.toObject().as<NativeObject>().isIndexed();



  // Try attaching a call stub.

  bool handled = false;

  if (op != JSOp::SpreadEval && op != JSOp::StrictSpreadEval &&

      stub->state().canAttachStub()) {

      stub->state().canAttachStub() && !isIndexed) {

    // Try CacheIR first:

    Rooted<ArrayObject*> aobj(cx, &arr.toObject().as<ArrayObject>());

    MOZ_ASSERT(IsPackedArray(aobj));

js/src/jit/CacheIR.cpp

+3 −1
Changes for js/src/jit/CacheIR.cpp: 3 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -6431,7 +6431,9 @@ ObjOperandId InlinableNativeIRGenerator::emitLoadArgsArray() { 
  MOZ_ASSERT(!hasBoundArguments());









  if (flags_.getArgFormat() == CallFlags::Spread) {









    return writer.loadSpreadArgs();









    ObjOperandId result = writer.loadSpreadArgs();









    writer.guardArrayIsPacked(result);









    return result;









  }

















  MOZ_ASSERT(flags_.getArgFormat() == CallFlags::FunApplyArray);