tor-browser

commit cf58c74aeba6770db545edf39d72f25a6423bad3
parent df03e21143f20dca1e5e5309d4fc882372250093
Author: alexical <dothayer@mozilla.com>
Date:   Mon,  1 Dec 2025 18:07:36 +0000

Bug 2001389 - Handle MegamorphicLoadSlotByValuePermissive in more places r=iain

Differential Revision: https://phabricator.services.mozilla.com/D273464

Diffstat:
A
js/src/jit-test/tests/ion/iterator-indices-megamorphic-permissive.js
 | 
47
+++++++++++++++++++++++++++++++++++++++++++++++
M
js/src/jit/IonAnalysis.cpp
 | 
6
++++++

2 files changed, 53 insertions(+), 0 deletions(-)
diff --git a/js/src/jit-test/tests/ion/iterator-indices-megamorphic-permissive.js b/js/src/jit-test/tests/ion/iterator-indices-megamorphic-permissive.js
@@ -0,0 +1,47 @@
+function test(obj, expected) {
+  var count = 0;
+  for (var s in obj) {
+    if (obj.hasOwnProperty(s)) {
+      count += obj[s];
+    }
+  }
+  assertEq(count, expected);
+}
+
+function test2(obj, expected) {
+  var count = 0;
+  var keys = Object.keys(obj);
+  for (var i = 0; i < keys.length; i++) {
+    var s = keys[i];
+    if (obj.hasOwnProperty(s)) {
+      count += obj[s];
+    }
+  }
+  assertEq(count, expected);
+}
+
+var arr = [];
+for (var i = 0; i < 20; i++) {
+  var obj = {};
+  for (var j = 0; j < i; j++) {
+    if (j == i - 1) {
+      Object.defineProperty(obj, "x_" + i + "_" + j, {
+        get() {
+          return 1;
+        },
+        enumerable: true,
+      })
+    } else {
+      obj["x_" + i + "_" + j] = 1;
+    }
+  }
+
+  arr.push(obj);
+}
+
+with ({}) {}
+for (var i = 0; i < 2000; i++) {
+  var idx = i % arr.length;
+  test(arr[idx], idx);
+  test2(arr[idx], idx);
+}
diff --git a/js/src/jit/IonAnalysis.cpp b/js/src/jit/IonAnalysis.cpp
@@ -4243,6 +4243,8 @@ bool jit::MarkLoadsUsedAsPropertyKeys(MIRGraph& graph) {
         idVal = ins->toGetPropSuperCache()->idval();
       } else if (ins->isMegamorphicLoadSlotByValue()) {
         idVal = ins->toMegamorphicLoadSlotByValue()->idVal();
+      } else if (ins->isMegamorphicLoadSlotByValuePermissive()) {
+        idVal = ins->toMegamorphicLoadSlotByValuePermissive()->idVal();
       } else if (ins->isMegamorphicHasProp()) {
         idVal = ins->toMegamorphicHasProp()->idVal();
       } else if (ins->isMegamorphicSetElement()) {
@@ -5203,6 +5205,9 @@ bool jit::OptimizeIteratorIndices(const MIRGenerator* mir, MIRGraph& graph) {
       } else if (ins->isMegamorphicLoadSlotByValue()) {
         receiver = ins->toMegamorphicLoadSlotByValue()->object();
         idVal = ins->toMegamorphicLoadSlotByValue()->idVal();
+      } else if (ins->isMegamorphicLoadSlotByValuePermissive()) {
+        receiver = ins->toMegamorphicLoadSlotByValuePermissive()->object();
+        idVal = ins->toMegamorphicLoadSlotByValuePermissive()->idVal();
       } else if (ins->isGetPropertyCache()) {
         receiver = ins->toGetPropertyCache()->value();
         idVal = ins->toGetPropertyCache()->idval();
@@ -5317,6 +5322,7 @@ bool jit::OptimizeIteratorIndices(const MIRGenerator* mir, MIRGraph& graph) {
         MOZ_ASSERT(!setValue);
         replacement = MConstant::NewBoolean(graph.alloc(), true);
       } else if (ins->isMegamorphicLoadSlotByValue() ||
+                 ins->isMegamorphicLoadSlotByValuePermissive() ||
                  ins->isGetPropertyCache()) {
         MOZ_ASSERT(!setValue);
         if (iterElementIndex) {