From 26b8a4ad86451b19c3c60bf50f73bd0ad56c4c76 Mon Sep 17 00:00:00 2001
From: "Nicolas B. Pierron" <nicolas.b.pierron@mozilla.com>
Date: Fri, 12 Sep 2014 16:19:24 +0200
Subject: [PATCH] Bug 1063918 - IonMonkey: Replace untyped loads by boxed value
 of the store. r=h4writer

---
 js/src/jit/MIR.cpp | 35 +++++++++++++++++++++++------------
 js/src/jit/MIR.h   |  7 +++++++
 2 files changed, 30 insertions(+), 12 deletions(-)

diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index 145558a724b..dfbb75b65ab 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -222,6 +222,26 @@ MDefinition::foldsTo(TempAllocator &alloc)
     return this;
 }
 
+MDefinition *
+MInstruction::foldsToStoredValue(TempAllocator &alloc, MDefinition *loaded)
+{
+    // If the type are matching then we return the value which is used as
+    // argument of the store.
+    if (loaded->type() != type()) {
+        // If we expect to read a type which is more generic than the type seen
+        // by the store, then we box the value used by the store.
+        if (type() != MIRType_Value)
+            return this;
+
+        MOZ_ASSERT(loaded->type() < MIRType_Value);
+        MBox *box = MBox::New(alloc, loaded);
+        block()->insertBefore(this, box);
+        loaded = box;
+    }
+
+    return loaded;
+}
+
 void
 MDefinition::analyzeEdgeCasesForward()
 {
@@ -3066,10 +3086,7 @@ MLoadFixedSlot::foldsTo(TempAllocator &alloc)
     if (store->slot() != slot())
         return this;
 
-    if (store->value()->type() != type())
-        return this;
-
-    return store->value();
+    return foldsToStoredValue(alloc, store->value());
 }
 
 bool
@@ -3208,10 +3225,7 @@ MLoadSlot::foldsTo(TempAllocator &alloc)
     if (store->slots() != slots())
         return this;
 
-    if (store->value()->type() != type())
-        return this;
-
-    return store->value();
+    return foldsToStoredValue(alloc, store->value());
 }
 
 MDefinition *
@@ -3230,10 +3244,7 @@ MLoadElement::foldsTo(TempAllocator &alloc)
     if (store->index() != index())
         return this;
 
-    if (store->value()->type() != type())
-        return this;
-
-    return store->value();
+    return foldsToStoredValue(alloc, store->value());
 }
 
 bool
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 288dca4ee3d..1bca0bc3586 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -831,6 +831,13 @@ class MInstruction
         resumePoint_(nullptr)
     { }
 
+    // Convenient function used for replacing a load by the value of the store
+    // if the types are match, and boxing the value if they do not match.
+    //
+    // Note: There is no need for such function in AsmJS functions as they do
+    // not use any MIRType_Value.
+    MDefinition *foldsToStoredValue(TempAllocator &alloc, MDefinition *loaded);
+
     void setResumePoint(MResumePoint *resumePoint);
 
     // Used to transfer the resume point to the rewritten instruction.