Bug 1010334 - Add recover functionality for Rsh; r=bbouvier

js/src/jit-test/tests/ion/dce-with-rinstructions.js

@@ -88,6 +88,25 @@ function rlsh_object(i) {
     return i;
 }
 
+var uceFault_rsh_number = eval(uneval(uceFault).replace('uceFault', 'uceFault_rsh_number'));
+function rrsh_number(i) {
+    var x = i >> 1;
+    if (uceFault_rsh_number(i) || uceFault_rsh_number(i))
+        assertEq(x, 49  /* = 99 >> 1 */);
+    return i;
+}
+
+var uceFault_rsh_object = eval(uneval(uceFault).replace('uceFault', 'uceFault_rsh_object'));
+function rrsh_object(i) {
+    var t = i;
+    var o = { valueOf: function () { return t; } };
+    var x = o >> 1; /* computed with t == i, not 1000 */
+    t = 1000;
+    if (uceFault_rsh_object(i) || uceFault_rsh_object(i))
+        assertEq(x, 49  /* = 99 >> 1 */);
+    return i;
+}
+
 var uceFault_ursh_number = eval(uneval(uceFault).replace('uceFault', 'uceFault_ursh_number'));
 function rursh_number(i) {
     var x = i >>> 1;
@@ -153,6 +172,8 @@ for (i = 0; i < 100; i++) {
     rbitxor_object(i);
     rlsh_number(i);
     rlsh_object(i);
+    rrsh_number(i);
+    rrsh_object(i);
     rursh_number(i);
     rursh_object(i);
     radd_number(i);

js/src/jit/MIR.h

@@ -3685,6 +3685,11 @@ class MRsh : public MShiftInstruction
         return getOperand(0);
     }
     void computeRange(TempAllocator &alloc);
+
+    bool writeRecoverData(CompactBufferWriter &writer) const;
+    bool canRecoverOnBailout() const {
+        return specialization_ < MIRType_Object;
+    }
 };
 
 class MUrsh : public MShiftInstruction

js/src/jit/Recover.cpp

@@ -243,6 +243,33 @@ RLsh::recover(JSContext *cx, SnapshotIterator &iter) const
     return true;
 }
 
+bool
+MRsh::writeRecoverData(CompactBufferWriter &writer) const
+{
+    MOZ_ASSERT(canRecoverOnBailout());
+    writer.writeUnsigned(uint32_t(RInstruction::Recover_Rsh));
+    return true;
+}
+
+RRsh::RRsh(CompactBufferReader &reader)
+{ }
+
+bool
+RRsh::recover(JSContext *cx, SnapshotIterator &iter) const
+{
+    RootedValue lhs(cx, iter.read());
+    RootedValue rhs(cx, iter.read());
+    MOZ_ASSERT(!lhs.isObject() && !rhs.isObject());
+
+    int32_t result;
+    if (!js::BitRsh(cx, lhs, rhs, &result))
+        return false;
+
+    RootedValue rootedResult(cx, js::Int32Value(result));
+    iter.storeInstructionResult(rootedResult);
+    return true;
+}
+
 bool
 MUrsh::writeRecoverData(CompactBufferWriter &writer) const
 {

js/src/jit/Recover.h

@@ -22,6 +22,7 @@ namespace jit {
     _(BitOr)                                    \
     _(BitXor)                                   \
     _(Lsh)                                      \
+    _(Rsh)                                      \
     _(Ursh)                                     \
     _(Add)                                      \
     _(NewObject)                                \
@@ -141,6 +142,18 @@ class RLsh MOZ_FINAL : public RInstruction
     bool recover(JSContext *cx, SnapshotIterator &iter) const;
 };
 
+class RRsh MOZ_FINAL : public RInstruction
+{
+  public:
+    RINSTRUCTION_HEADER_(Rsh)
+
+    virtual uint32_t numOperands() const {
+        return 2;
+    }
+
+    bool recover(JSContext *cx, SnapshotIterator &iter) const;
+};
+
 class RUrsh MOZ_FINAL : public RInstruction
 {
   public: