From fe8090f4931840fc8e23a005bea8bbdd1be23579 Mon Sep 17 00:00:00 2001
From: David Anderson <danderson@mozilla.com>
Date: Fri, 17 Sep 2010 10:41:29 -0700
Subject: [PATCH] Compile JSOP_IN (bug 594111, r=dmandelin).

---
 js/src/methodjit/Compiler.cpp  |  8 ++++++++
 js/src/methodjit/StubCalls.cpp | 28 ++++++++++++++++++++++++++++
 js/src/methodjit/StubCalls.h   |  1 +
 3 files changed, 37 insertions(+)

diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index 79d5c2665d..a15e5ee7ca 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -1321,6 +1321,14 @@ mjit::Compiler::generateMethod()
             frame.pop();
           END_CASE(JSOP_THROW)
 
+          BEGIN_CASE(JSOP_IN)
+            prepareStubCall(Uses(2));
+            stubCall(stubs::In);
+            frame.popn(2);
+            frame.takeReg(Registers::ReturnReg);
+            frame.pushTypedPayload(JSVAL_TYPE_BOOLEAN, Registers::ReturnReg);
+          END_CASE(JSOP_IN)
+
           BEGIN_CASE(JSOP_INSTANCEOF)
             jsop_instanceof();
           END_CASE(JSOP_INSTANCEOF)
diff --git a/js/src/methodjit/StubCalls.cpp b/js/src/methodjit/StubCalls.cpp
index d8bccdea3e..0734c8cb99 100644
--- a/js/src/methodjit/StubCalls.cpp
+++ b/js/src/methodjit/StubCalls.cpp
@@ -2762,6 +2762,34 @@ stubs::DefVar(VMFrame &f, JSAtom *atom)
     obj2->dropProperty(cx, prop);
 }
 
+JSBool JS_FASTCALL
+stubs::In(VMFrame &f)
+{
+    JSContext *cx = f.cx;
+
+    const Value &rref = f.regs.sp[-1];
+    if (!rref.isObject()) {
+        js_ReportValueError(cx, JSMSG_IN_NOT_OBJECT, -1, rref, NULL);
+        THROWV(JS_FALSE);
+    }
+
+    JSObject *obj = &rref.toObject();
+    jsid id;
+    if (!FetchElementId(f, obj, f.regs.sp[-2], id, &f.regs.sp[-2]))
+        THROWV(JS_FALSE);
+
+    JSObject *obj2;
+    JSProperty *prop;
+    if (!obj->lookupProperty(cx, id, &obj2, &prop))
+        THROWV(JS_FALSE);
+
+    JSBool cond = !!prop;
+    if (prop)
+        obj2->dropProperty(cx, prop);
+
+    return cond;
+}
+
 template void JS_FASTCALL stubs::DelElem<true>(VMFrame &f);
 template void JS_FASTCALL stubs::DelElem<false>(VMFrame &f);
 
diff --git a/js/src/methodjit/StubCalls.h b/js/src/methodjit/StubCalls.h
index d46b97f7dd..a89b48d946 100644
--- a/js/src/methodjit/StubCalls.h
+++ b/js/src/methodjit/StubCalls.h
@@ -148,6 +148,7 @@ void JS_FASTCALL CallProp(VMFrame &f, JSAtom *atom);
 template <JSBool strict> void JS_FASTCALL DelProp(VMFrame &f, JSAtom *atom);
 template <JSBool strict> void JS_FASTCALL DelElem(VMFrame &f);
 void JS_FASTCALL DelName(VMFrame &f, JSAtom *atom);
+JSBool JS_FASTCALL In(VMFrame &f);
 
 void JS_FASTCALL DefVar(VMFrame &f, JSAtom *atom);
 template<JSBool strict> void JS_FASTCALL DefFun(VMFrame &f, JSFunction *fun);
-- 
2.11.4.GIT