Kraken's crypto tests use array.push and array.concat a lot. JM+TI inlines these functions, and also inlines array.pop and array.shift. IM should do the same.

This is a small v8-deltablue win. I can land the jsarray* changes on m-c first.

The stub calls js::array_push directly now. I think I will change part 1 to do the same to avoid the jsarray* changes/complexity. I will add array.concat once we have inline object allocation.

Comment on attachment 610058 [details] [diff] [review] Part 1: Inline pop and shift Review of attachment 610058 [details] [diff] [review]: ----------------------------------------------------------------- Nice. ::: js/src/ion/VMFunctions.cpp @@ +238,5 @@ > > +static inline void > +SetReturnOverrideIfInvalidated(JSContext *cx, const Value &rval) > +{ > + if (!GetTopIonJSScript(cx)->ion) This isn't quite enough, I think, because ->ion could be ION_DISABLED_SCRIPT or (maybe worse). You need to cache the original IonScript. Maybe we should have an AutoDetectInvalidation.

Avoids most of the jsarray.* changes and I added the AutoDetectInvalidation class you suggested.

Comment on attachment 611511 [details] [diff] [review] Part 1: Inline pop and shift - v2 Review of attachment 611511 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/ion/VMFunctions.cpp @@ +252,5 @@ > + // If the result is |undefined|, the array was probably empty and we > + // have to monitor the return value. > + *rval = argv[0]; > + if (rval->isUndefined()) { > + AutoDetectInvalidation adi(cx, rval); I think it's better to move these AutoDetectInvalidation calls to the very top, since a slight breeze can invalidate script->ion, it's safer to grab it ASAP.

https://hg.mozilla.org/projects/ionmonkey/rev/cdc5f3570a4c https://hg.mozilla.org/projects/ionmonkey/rev/7b2c14a9fde2 Keeping this bug open for array.concat.

Marking FIXED, we can file a follow-up for array.concat.