Bug 1028556 - IonMonkey: Implement Pow Recover Instruction. r=nbp

js/src/jit-test/tests/ion/dce-with-rinstructions.js

@@ -304,6 +304,25 @@ function rconcat_number(i) {
     return i;
 }
 
+var uceFault_pow_number = eval(uneval(uceFault).replace('uceFault', 'uceFault_pow_number'));
+function rpow_number(i) {
+    var x = Math.pow(i, 3.14159);
+    if (uceFault_pow_number(i) || uceFault_pow_number(i))
+        assertEq(x, Math.pow(99, 3.14159));
+    return i;
+}
+
+var uceFault_pow_object = eval(uneval(uceFault).replace('uceFault', 'uceFault_pow_object'));
+function rpow_object(i) {
+    var t = i;
+    var o = { valueOf: function () { return t; } };
+    var x = Math.pow(o, 3.14159); /* computed with t == i, not 1.5 */
+    t = 1.5;
+    if (uceFault_bitnot_object(i) || uceFault_bitnot_object(i))
+        assertEq(x, Math.pow(99, 3.14159));
+    return i;
+}
+
 for (i = 0; i < 100; i++) {
     rbitnot_number(i);
     rbitnot_object(i);
@@ -336,6 +355,8 @@ for (i = 0; i < 100; i++) {
     rconcat_string(i);
     rconcat_number(i);
     rround_number(i);
+    rpow_number(i);
+    rpow_object(i);
 }
 
 // Test that we can refer multiple time to the same recover instruction, as well

js/src/jit/MIR.h

@@ -4158,6 +4158,10 @@ class MPow
     bool possiblyCalls() const {
         return true;
     }
+    bool writeRecoverData(CompactBufferWriter &writer) const;
+    bool canRecoverOnBailout() const {
+        return true;
+    }
 };
 
 // Inline implementation of Math.pow(x, 0.5), which subtly differs from Math.sqrt(x).

js/src/jit/Recover.cpp

@@ -534,6 +534,32 @@ RRound::recover(JSContext *cx, SnapshotIterator &iter) const
     return true;
 }
 
+bool
+MPow::writeRecoverData(CompactBufferWriter &writer) const
+{
+    MOZ_ASSERT(canRecoverOnBailout());
+    writer.writeUnsigned(uint32_t(RInstruction::Recover_Pow));
+    return true;
+}
+
+RPow::RPow(CompactBufferReader &reader)
+{ }
+
+bool
+RPow::recover(JSContext *cx, SnapshotIterator &iter) const
+{
+    RootedValue base(cx, iter.read());
+    RootedValue power(cx, iter.read());
+    RootedValue result(cx);
+
+    MOZ_ASSERT(base.isNumber() && power.isNumber());
+    if (!js_math_pow_handle(cx, base, power, &result))
+        return false;
+
+    iter.storeInstructionResult(result);
+    return true;
+}
+
 bool
 MNewObject::writeRecoverData(CompactBufferWriter &writer) const
 {

js/src/jit/Recover.h

@@ -32,6 +32,7 @@ namespace jit {
     _(Mod)                                      \
     _(Concat)                                   \
     _(Round)                                    \
+    _(Pow)                                      \
     _(NewObject)                                \
     _(NewDerivedTypedObject)
 
@@ -281,6 +282,18 @@ class RRound MOZ_FINAL : public RInstruction
     bool recover(JSContext *cx, SnapshotIterator &iter) const;
 };
 
+class RPow MOZ_FINAL : public RInstruction
+{
+  public:
+    RINSTRUCTION_HEADER_(Pow)
+
+    virtual uint32_t numOperands() const {
+        return 2;
+    }
+
+    bool recover(JSContext *cx, SnapshotIterator &iter) const;
+};
+
 class RNewObject MOZ_FINAL : public RInstruction
 {
   private:

js/src/jsmath.cpp

@@ -662,22 +662,28 @@ js::ecmaPow(double x, double y)
 #if defined(_MSC_VER)
 # pragma optimize("g", off)
 #endif
+bool
+js_math_pow_handle(JSContext *cx, HandleValue base, HandleValue power, MutableHandleValue result)
+{
+    double x;
+    if (!ToNumber(cx, base, &x))
+        return false;
+
+    double y;
+    if (!ToNumber(cx, power, &y))
+        return false;
+
+    double z = ecmaPow(x, y);
+    result.setNumber(z);
+    return true;
+}
+
 bool
 js_math_pow(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    double x;
+    return js_math_pow_handle(cx, args.get(0), args.get(1), args.rval());
-    if (!ToNumber(cx, args.get(0), &x))
-        return false;
-
-    double y;
-    if (!ToNumber(cx, args.get(1), &y))
-        return false;
-
-    double z = ecmaPow(x, y);
-    args.rval().setNumber(z);
-    return true;
 }
 #if defined(_MSC_VER)
 # pragma optimize("", on)

js/src/jsmath.h

@@ -110,6 +110,9 @@ js_math_min(JSContext *cx, unsigned argc, js::Value *vp);
 extern bool
 js_math_sqrt(JSContext *cx, unsigned argc, js::Value *vp);
 
+extern bool
+js_math_pow_handle(JSContext *cx, js::HandleValue base, js::HandleValue power, js::MutableHandleValue result);
+
 extern bool
 js_math_pow(JSContext *cx, unsigned argc, js::Value *vp);