From 21c1bebfcc9ddbb179aa022b85f7906183393ff7 Mon Sep 17 00:00:00 2001 From: Wes Kocher Date: Thu, 3 Apr 2014 13:52:36 -0700 Subject: [PATCH] Backed out 3 changesets (bug 977126) for mochitest-2 bustage on Windows Backed out changeset 2daa537b62e6 (bug 977126) Backed out changeset d87a13b71afc (bug 977126) Backed out changeset 3bd335914852 (bug 977126) --- js/src/assembler/assembler/X86Assembler.h | 7 --- js/src/builtin/TypedObject.cpp | 23 ++-------- js/src/builtin/TypedObject.h | 12 ++--- js/src/jit/CodeGenerator.cpp | 53 +---------------------- js/src/jit/CodeGenerator.h | 1 - js/src/jit/IonBuilder.h | 1 - js/src/jit/LIR-Common.h | 25 ----------- js/src/jit/LOpcodes.h | 1 - js/src/jit/Lowering.cpp | 10 ----- js/src/jit/Lowering.h | 1 - js/src/jit/MCallOptimize.cpp | 45 ------------------- js/src/jit/MIR.h | 40 +---------------- js/src/jit/MOpcodes.h | 1 - js/src/jit/ParallelSafetyAnalysis.cpp | 1 - js/src/jit/arm/MacroAssembler-arm.cpp | 8 ---- js/src/jit/arm/MacroAssembler-arm.h | 1 - js/src/jit/shared/Assembler-x86-shared.h | 12 ----- js/src/jit/x64/Assembler-x64.h | 12 ----- js/src/jit/x64/MacroAssembler-x64.h | 3 -- js/src/jit/x86/MacroAssembler-x86.h | 3 -- js/src/vm/SelfHosting.cpp | 4 +- 21 files changed, 13 insertions(+), 251 deletions(-) diff --git a/js/src/assembler/assembler/X86Assembler.h b/js/src/assembler/assembler/X86Assembler.h index 9786852a82b..0ccef86ab4d 100644 --- a/js/src/assembler/assembler/X86Assembler.h +++ b/js/src/assembler/assembler/X86Assembler.h @@ -942,13 +942,6 @@ public: m_formatter.oneByteOp64(OP_SUB_EvGv, src, dst); } - void subq_rm(RegisterID src, int offset, RegisterID base) - { - spew("subq %s, %s0x%x(%s)", - nameIReg(8,src), PRETTY_PRINT_OFFSET(offset), nameIReg(8,base)); - m_formatter.oneByteOp64(OP_SUB_EvGv, src, base, offset); - } - void subq_mr(int offset, RegisterID base, RegisterID dst) { spew("subq %s0x%x(%s), %s", diff --git a/js/src/builtin/TypedObject.cpp b/js/src/builtin/TypedObject.cpp index b2cc4fa0d94..62f1bca7d2c 100644 --- a/js/src/builtin/TypedObject.cpp +++ b/js/src/builtin/TypedObject.cpp @@ -2215,24 +2215,18 @@ TypedObject::obj_enumerate(JSContext *cx, HandleObject obj, JSIterateOp enum_op, } /* static */ size_t -TypedObject::offsetOfOwnerSlot() +TypedObject::ownerOffset() { return JSObject::getFixedSlotOffset(JS_TYPEDOBJ_SLOT_OWNER); } /* static */ size_t -TypedObject::offsetOfDataSlot() +TypedObject::dataOffset() { // the offset of 7 is based on the alloc kind return JSObject::getPrivateDataOffset(JS_TYPEDOBJ_SLOT_DATA); } -/* static */ size_t -TypedObject::offsetOfByteOffsetSlot() -{ - return JSObject::getFixedSlotOffset(JS_TYPEDOBJ_SLOT_BYTEOFFSET); -} - void TypedObject::neuter(void *newData) { @@ -2718,21 +2712,12 @@ js::SetTypedObjectOffset(ThreadSafeContext *, unsigned argc, Value *vp) typedObj.setPrivate(typedObj.owner().dataPointer() + offset); typedObj.setReservedSlot(JS_TYPEDOBJ_SLOT_BYTEOFFSET, Int32Value(offset)); - args.rval().setUndefined(); return true; } -bool -js::intrinsic_SetTypedObjectOffset(JSContext *cx, unsigned argc, Value *vp) -{ - // Do not use JSNativeThreadSafeWrapper<> so that ion can reference - // this function more easily when inlining. - return SetTypedObjectOffset(cx, argc, vp); -} - -JS_JITINFO_NATIVE_PARALLEL_THREADSAFE(js::intrinsic_SetTypedObjectOffsetJitInfo, +JS_JITINFO_NATIVE_PARALLEL_THREADSAFE(js::SetTypedObjectOffsetJitInfo, SetTypedObjectJitInfo, - SetTypedObjectOffset); + js::SetTypedObjectOffset); bool js::ObjectIsTypeDescr(ThreadSafeContext *, unsigned argc, Value *vp) diff --git a/js/src/builtin/TypedObject.h b/js/src/builtin/TypedObject.h index a0bcdaca135..2574fa308ae 100644 --- a/js/src/builtin/TypedObject.h +++ b/js/src/builtin/TypedObject.h @@ -585,7 +585,7 @@ class TypedObject : public ArrayBufferViewObject MutableHandleValue statep, MutableHandleId idp); public: - static size_t offsetOfOwnerSlot(); + static size_t ownerOffset(); // Each typed object contains a void* pointer pointing at the // binary data that it represents. (That data may be owned by this @@ -593,10 +593,7 @@ class TypedObject : public ArrayBufferViewObject // This function returns the offset in bytes within the object // where the `void*` pointer can be found. It is intended for use // by the JIT. - static size_t offsetOfDataSlot(); - - // Offset of the byte offset slot. - static size_t offsetOfByteOffsetSlot(); + static size_t dataOffset(); // Helper for createUnattached() static TypedObject *createUnattachedWithClass(JSContext *cx, @@ -745,9 +742,8 @@ extern const JSJitInfo AttachTypedObjectJitInfo; * Changes the offset for `typedObj` within its buffer to `offset`. * `typedObj` must already be attached. */ -bool intrinsic_SetTypedObjectOffset(JSContext *cx, unsigned argc, Value *vp); -bool SetTypedObjectOffset(ThreadSafeContext *, unsigned argc, Value *vp); -extern const JSJitInfo intrinsic_SetTypedObjectOffsetJitInfo; +bool SetTypedObjectOffset(ThreadSafeContext *cx, unsigned argc, Value *vp); +extern const JSJitInfo SetTypedObjectOffsetJitInfo; /* * Usage: ObjectIsTypeDescr(obj) diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp index 6ccef14d9bb..697e3c4ace5 100644 --- a/js/src/jit/CodeGenerator.cpp +++ b/js/src/jit/CodeGenerator.cpp @@ -4112,7 +4112,7 @@ CodeGenerator::visitNeuterCheck(LNeuterCheck *lir) Register obj = ToRegister(lir->object()); Register temp = ToRegister(lir->temp()); - masm.extractObject(Address(obj, TypedObject::offsetOfOwnerSlot()), temp); + masm.extractObject(Address(obj, TypedObject::ownerOffset()), temp); masm.unboxInt32(Address(temp, ArrayBufferObject::flagsOffset()), temp); masm.and32(Imm32(ArrayBufferObject::neuteredFlag()), temp); @@ -4126,56 +4126,7 @@ CodeGenerator::visitTypedObjectElements(LTypedObjectElements *lir) { Register obj = ToRegister(lir->object()); Register out = ToRegister(lir->output()); - masm.loadPtr(Address(obj, TypedObject::offsetOfDataSlot()), out); - return true; -} - -bool -CodeGenerator::visitSetTypedObjectOffset(LSetTypedObjectOffset *lir) -{ - Register object = ToRegister(lir->object()); - Register offset = ToRegister(lir->offset()); - Register temp0 = ToRegister(lir->temp0()); - - // `offset` is an absolute offset into the base buffer. One way - // to implement this instruction would be load the base address - // from the buffer and add `offset`. But that'd be an extra load. - // We can instead load the current base pointer and current - // offset, compute the difference with `offset`, and then adjust - // the current base pointer. This is two loads but to adjacent - // fields in the same object, which should come in the same cache - // line. - // - // The C code I would probably write is the following: - // - // void SetTypedObjectOffset(TypedObject *obj, int32_t offset) { - // int32_t temp0 = obj->byteOffset; - // obj->pointer = obj->pointer - temp0 + offset; - // obj->byteOffset = offset; - // } - // - // But what we actually compute is more like this, because it - // saves us a temporary to do it this way: - // - // void SetTypedObjectOffset(TypedObject *obj, int32_t offset) { - // int32_t temp0 = obj->byteOffset; - // obj->pointer = obj->pointer - (temp0 - offset); - // obj->byteOffset = offset; - // } - - // temp0 = typedObj->byteOffset; - masm.unboxInt32(Address(object, TypedObject::offsetOfByteOffsetSlot()), temp0); - - // temp0 -= offset; - masm.subPtr(offset, temp0); - - // obj->pointer -= temp0; - masm.subPtr(temp0, Address(object, TypedObject::offsetOfDataSlot())); - - // obj->byteOffset = offset; - masm.storeValue(JSVAL_TYPE_INT32, offset, - Address(object, TypedObject::offsetOfByteOffsetSlot())); - + masm.loadPtr(Address(obj, TypedObject::dataOffset()), out); return true; } diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h index 3a0482c6673..9580ec3c58f 100644 --- a/js/src/jit/CodeGenerator.h +++ b/js/src/jit/CodeGenerator.h @@ -167,7 +167,6 @@ class CodeGenerator : public CodeGeneratorSpecific bool visitTypedArrayElements(LTypedArrayElements *lir); bool visitNeuterCheck(LNeuterCheck *lir); bool visitTypedObjectElements(LTypedObjectElements *lir); - bool visitSetTypedObjectOffset(LSetTypedObjectOffset *lir); bool visitStringLength(LStringLength *lir); bool visitInitializedLength(LInitializedLength *lir); bool visitSetInitializedLength(LSetInitializedLength *lir); diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h index 285faa02e39..a81a2a59116 100644 --- a/js/src/jit/IonBuilder.h +++ b/js/src/jit/IonBuilder.h @@ -696,7 +696,6 @@ class IonBuilder : public MIRGenerator // TypedObject intrinsics. InliningStatus inlineObjectIsTypeDescr(CallInfo &callInfo); - InliningStatus inlineSetTypedObjectOffset(CallInfo &callInfo); bool elementAccessIsTypedObjectArrayOfScalarType(MDefinition* obj, MDefinition* id, ScalarTypeDescr::Type *arrayType); diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h index 0605e4203b7..5cdfc389c28 100644 --- a/js/src/jit/LIR-Common.h +++ b/js/src/jit/LIR-Common.h @@ -3725,31 +3725,6 @@ class LTypedObjectElements : public LInstructionHelper<1, 1, 0> } }; -// Load a typed array's elements vector. -class LSetTypedObjectOffset : public LInstructionHelper<0, 2, 1> -{ - public: - LIR_HEADER(SetTypedObjectOffset) - - LSetTypedObjectOffset(const LAllocation &object, - const LAllocation &offset, - const LDefinition &temp0) - { - setOperand(0, object); - setOperand(1, offset); - setTemp(0, temp0); - } - const LAllocation *object() { - return getOperand(0); - } - const LAllocation *offset() { - return getOperand(1); - } - const LDefinition *temp0() { - return getTemp(0); - } -}; - // Check whether a typed object has a neutered owner buffer. class LNeuterCheck : public LInstructionHelper<0, 1, 1> { diff --git a/js/src/jit/LOpcodes.h b/js/src/jit/LOpcodes.h index 54f2ce16227..c47b8941219 100644 --- a/js/src/jit/LOpcodes.h +++ b/js/src/jit/LOpcodes.h @@ -249,7 +249,6 @@ _(TypedArrayLength) \ _(TypedArrayElements) \ _(TypedObjectElements) \ - _(SetTypedObjectOffset) \ _(StringLength) \ _(ArgumentsLength) \ _(GetFrameArgument) \ diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp index 17aae384194..7f171215b88 100644 --- a/js/src/jit/Lowering.cpp +++ b/js/src/jit/Lowering.cpp @@ -2378,16 +2378,6 @@ LIRGenerator::visitTypedObjectElements(MTypedObjectElements *ins) return define(new(alloc()) LTypedObjectElements(useRegisterAtStart(ins->object())), ins); } -bool -LIRGenerator::visitSetTypedObjectOffset(MSetTypedObjectOffset *ins) -{ - return add(new(alloc()) LSetTypedObjectOffset( - useRegister(ins->object()), - useRegister(ins->offset()), - temp()), - ins); -} - bool LIRGenerator::visitInitializedLength(MInitializedLength *ins) { diff --git a/js/src/jit/Lowering.h b/js/src/jit/Lowering.h index b64332a9f6f..d4b5e1de060 100644 --- a/js/src/jit/Lowering.h +++ b/js/src/jit/Lowering.h @@ -178,7 +178,6 @@ class LIRGenerator : public LIRGeneratorSpecific bool visitTypedArrayElements(MTypedArrayElements *ins); bool visitNeuterCheck(MNeuterCheck *lir); bool visitTypedObjectElements(MTypedObjectElements *ins); - bool visitSetTypedObjectOffset(MSetTypedObjectOffset *ins); bool visitInitializedLength(MInitializedLength *ins); bool visitSetInitializedLength(MSetInitializedLength *ins); bool visitNot(MNot *ins); diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp index 86205c43316..3872ecfea2a 100644 --- a/js/src/jit/MCallOptimize.cpp +++ b/js/src/jit/MCallOptimize.cpp @@ -7,7 +7,6 @@ #include "jsmath.h" #include "builtin/TestingFunctions.h" -#include "builtin/TypedObject.h" #include "jit/BaselineInspector.h" #include "jit/IonBuilder.h" #include "jit/Lowering.h" @@ -178,8 +177,6 @@ IonBuilder::inlineNativeCall(CallInfo &callInfo, JSNative native) return inlineHasClass(callInfo, &SizedArrayTypeDescr::class_); if (native == intrinsic_TypeDescrIsUnsizedArrayType) return inlineHasClass(callInfo, &UnsizedArrayTypeDescr::class_); - if (native == intrinsic_SetTypedObjectOffset) - return inlineSetTypedObjectOffset(callInfo); // Testing Functions if (native == testingFunc_inParallelSection) @@ -1652,48 +1649,6 @@ IonBuilder::inlineObjectIsTypeDescr(CallInfo &callInfo) return InliningStatus_Inlined; } -IonBuilder::InliningStatus -IonBuilder::inlineSetTypedObjectOffset(CallInfo &callInfo) -{ - if (callInfo.argc() != 2 || callInfo.constructing()) - return InliningStatus_NotInlined; - - MDefinition *typedObj = callInfo.getArg(0); - MDefinition *offset = callInfo.getArg(1); - - // Return type should be undefined or something wacky is going on. - if (getInlineReturnType() != MIRType_Undefined) - return InliningStatus_NotInlined; - - // Check typedObj is a, well, typed object. Go ahead and use TI - // data. If this check should fail, that is almost certainly a bug - // in self-hosted code -- either because it's not being careful - // with TI or because of something else -- but we'll just let it - // fall through to the SetTypedObjectOffset intrinsic in such - // cases. - types::TemporaryTypeSet *types = typedObj->resultTypeSet(); - if (typedObj->type() != MIRType_Object || !types) - return InliningStatus_NotInlined; - switch (types->forAllClasses(IsTypedObjectClass)) { - case types::TemporaryTypeSet::ForAllResult::ALL_FALSE: - case types::TemporaryTypeSet::ForAllResult::EMPTY: - case types::TemporaryTypeSet::ForAllResult::MIXED: - return InliningStatus_NotInlined; - case types::TemporaryTypeSet::ForAllResult::ALL_TRUE: - break; - } - - // Check type of offset argument is an integer. - if (offset->type() != MIRType_Int32) - return InliningStatus_NotInlined; - - callInfo.setImplicitlyUsedUnchecked(); - MInstruction *ins = MSetTypedObjectOffset::New(alloc(), typedObj, offset); - current->add(ins); - current->push(ins); - return InliningStatus_Inlined; -} - IonBuilder::InliningStatus IonBuilder::inlineUnsafeSetReservedSlot(CallInfo &callInfo) { diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h index 60c0ebee4a3..0d1f5d29b11 100644 --- a/js/src/jit/MIR.h +++ b/js/src/jit/MIR.h @@ -1561,7 +1561,7 @@ class MAbortPar : public MAryControlInstruction<0, 0> MAbortPar() : MAryControlInstruction<0, 0>() { - setResultType(MIRType_None); + setResultType(MIRType_Undefined); setGuard(); } @@ -5593,44 +5593,6 @@ class MTypedObjectElements } }; -// Inlined version of the js::SetTypedObjectOffset() intrinsic. -class MSetTypedObjectOffset - : public MBinaryInstruction -{ - private: - MSetTypedObjectOffset(MDefinition *object, MDefinition *offset) - : MBinaryInstruction(object, offset) - { - JS_ASSERT(object->type() == MIRType_Object); - JS_ASSERT(offset->type() == MIRType_Int32); - setResultType(MIRType_None); - } - - public: - INSTRUCTION_HEADER(SetTypedObjectOffset) - - static MSetTypedObjectOffset *New(TempAllocator &alloc, - MDefinition *object, - MDefinition *offset) - { - return new(alloc) MSetTypedObjectOffset(object, offset); - } - - MDefinition *object() const { - return getOperand(0); - } - - MDefinition *offset() const { - return getOperand(1); - } - - AliasSet getAliasSet() const { - // This affects the result of MTypedObjectElements, - // which is described as a load of ObjectFields. - return AliasSet::Store(AliasSet::ObjectFields); - } -}; - // Perform !-operation class MNot : public MUnaryInstruction, diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h index f003b9d6c84..aca841f7307 100644 --- a/js/src/jit/MOpcodes.h +++ b/js/src/jit/MOpcodes.h @@ -135,7 +135,6 @@ namespace jit { _(TypedArrayLength) \ _(TypedArrayElements) \ _(TypedObjectElements) \ - _(SetTypedObjectOffset) \ _(InitializedLength) \ _(SetInitializedLength) \ _(Not) \ diff --git a/js/src/jit/ParallelSafetyAnalysis.cpp b/js/src/jit/ParallelSafetyAnalysis.cpp index b5e5fed17ae..09b6230b0ca 100644 --- a/js/src/jit/ParallelSafetyAnalysis.cpp +++ b/js/src/jit/ParallelSafetyAnalysis.cpp @@ -223,7 +223,6 @@ class ParallelSafetyVisitor : public MInstructionVisitor SAFE_OP(TypedArrayLength) SAFE_OP(TypedArrayElements) SAFE_OP(TypedObjectElements) - SAFE_OP(SetTypedObjectOffset) SAFE_OP(InitializedLength) WRITE_GUARDED_OP(SetInitializedLength, elements) SAFE_OP(Not) diff --git a/js/src/jit/arm/MacroAssembler-arm.cpp b/js/src/jit/arm/MacroAssembler-arm.cpp index dd350a3e78e..6ca7f36b6f3 100644 --- a/js/src/jit/arm/MacroAssembler-arm.cpp +++ b/js/src/jit/arm/MacroAssembler-arm.cpp @@ -2440,14 +2440,6 @@ MacroAssemblerARMCompat::subPtr(const Register &src, const Register &dest) ma_sub(src, dest); } -void -MacroAssemblerARMCompat::subPtr(const Register &src, const Address &dest) -{ - loadPtr(dest, ScratchRegister); - ma_sub(src, ScratchRegister); - storePtr(ScratchRegister, dest); -} - void MacroAssemblerARMCompat::addPtr(Imm32 imm, const Register dest) { diff --git a/js/src/jit/arm/MacroAssembler-arm.h b/js/src/jit/arm/MacroAssembler-arm.h index e55248f3f93..978208a6177 100644 --- a/js/src/jit/arm/MacroAssembler-arm.h +++ b/js/src/jit/arm/MacroAssembler-arm.h @@ -1357,7 +1357,6 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM void subPtr(Imm32 imm, const Register dest); void subPtr(const Address &addr, const Register dest); void subPtr(const Register &src, const Register &dest); - void subPtr(const Register &src, const Address &dest); void addPtr(Imm32 imm, const Register dest); void addPtr(Imm32 imm, const Address &dest); void addPtr(ImmWord imm, const Register dest) { diff --git a/js/src/jit/shared/Assembler-x86-shared.h b/js/src/jit/shared/Assembler-x86-shared.h index 5c1ace6fcf8..1868c255573 100644 --- a/js/src/jit/shared/Assembler-x86-shared.h +++ b/js/src/jit/shared/Assembler-x86-shared.h @@ -948,18 +948,6 @@ class AssemblerX86Shared MOZ_ASSUME_UNREACHABLE("unexpected operand kind"); } } - void subl(const Register &src, const Operand &dest) { - switch (dest.kind()) { - case Operand::REG: - masm.subl_rr(src.code(), dest.reg()); - break; - case Operand::MEM_REG_DISP: - masm.subl_rm(src.code(), dest.disp(), dest.base()); - break; - default: - MOZ_ASSUME_UNREACHABLE("unexpected operand kind"); - } - } void orl(const Register ®, const Register &dest) { masm.orl_rr(reg.code(), dest.code()); } diff --git a/js/src/jit/x64/Assembler-x64.h b/js/src/jit/x64/Assembler-x64.h index d77de0b1476..6ea67251571 100644 --- a/js/src/jit/x64/Assembler-x64.h +++ b/js/src/jit/x64/Assembler-x64.h @@ -449,18 +449,6 @@ class Assembler : public AssemblerX86Shared MOZ_ASSUME_UNREACHABLE("unexpected operand kind"); } } - void subq(const Register &src, const Operand &dest) { - switch (dest.kind()) { - case Operand::REG: - masm.subq_rr(src.code(), dest.reg()); - break; - case Operand::MEM_REG_DISP: - masm.subq_rm(src.code(), dest.disp(), dest.base()); - break; - default: - MOZ_ASSUME_UNREACHABLE("unexpected operand kind"); - } - } void shlq(Imm32 imm, const Register &dest) { masm.shlq_i8r(imm.value, dest.code()); } diff --git a/js/src/jit/x64/MacroAssembler-x64.h b/js/src/jit/x64/MacroAssembler-x64.h index 024e55d4225..fa273cbdc0c 100644 --- a/js/src/jit/x64/MacroAssembler-x64.h +++ b/js/src/jit/x64/MacroAssembler-x64.h @@ -554,9 +554,6 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared void subPtr(const Address &addr, const Register &dest) { subq(Operand(addr), dest); } - void subPtr(const Register &src, const Address &dest) { - subq(src, Operand(dest)); - } void branch32(Condition cond, const AbsoluteAddress &lhs, Imm32 rhs, Label *label) { if (JSC::X86Assembler::isAddressImmediate(lhs.addr)) { diff --git a/js/src/jit/x86/MacroAssembler-x86.h b/js/src/jit/x86/MacroAssembler-x86.h index a9134ca4545..8d81b9f57a2 100644 --- a/js/src/jit/x86/MacroAssembler-x86.h +++ b/js/src/jit/x86/MacroAssembler-x86.h @@ -561,9 +561,6 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared void subPtr(const Address &addr, const Register &dest) { subl(Operand(addr), dest); } - void subPtr(const Register &src, const Address &dest) { - subl(src, Operand(dest)); - } void branch32(Condition cond, const AbsoluteAddress &lhs, Imm32 rhs, Label *label) { cmpl(Operand(lhs), rhs); diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp index a6e8d77f0f0..ddd9d255563 100644 --- a/js/src/vm/SelfHosting.cpp +++ b/js/src/vm/SelfHosting.cpp @@ -748,8 +748,8 @@ static const JSFunctionSpec intrinsic_functions[] = { JSNativeThreadSafeWrapper, &js::AttachTypedObjectJitInfo, 3, 0), JS_FNINFO("SetTypedObjectOffset", - intrinsic_SetTypedObjectOffset, - &js::intrinsic_SetTypedObjectOffsetJitInfo, 2, 0), + JSNativeThreadSafeWrapper, + &js::SetTypedObjectOffsetJitInfo, 2, 0), JS_FNINFO("ObjectIsTypeDescr", intrinsic_ObjectIsTypeDescr, &js::ObjectIsTypeDescrJitInfo, 1, 0),