Bug 1024895 - Implementing Floor recover on bailout. r=nbp

js/src/jit-test/tests/ion/dce-with-rinstructions.js

@@ -163,6 +163,25 @@ function radd_float(i) {
     return i;
 }
 
+var uceFault_floor_number = eval(uneval(uceFault).replace('uceFault', 'uceFault_floor_number'));
+function rfloor_number(i) {
+    var x = Math.floor(i + 0.1111);
+    if (uceFault_floor_number(i) || uceFault_floor_number(i))
+        assertEq(x, i);
+    return i;
+}
+
+var uceFault_floor_object = eval(uneval(uceFault).replace('uceFault', 'uceFault_floor_object'));
+function rfloor_object(i) {
+    var t = i + 0.1111;
+    var o = { valueOf: function () { return t; } };
+    var x = Math.floor(o);
+    t = 1000.1111;
+    if (uceFault_floor_object(i) || uceFault_floor_object(i))
+        assertEq(x, i);
+    return i;
+}
+
 var uceFault_round_number = eval(uneval(uceFault).replace('uceFault', 'uceFault_round'));
 function rround_number(i) {
     var x = Math.round(i + 1.4);
@@ -362,6 +381,8 @@ for (i = 0; i < 100; i++) {
     rmod_object(i);
     rconcat_string(i);
     rconcat_number(i);
+    rfloor_number(i);
+    rfloor_object(i);
     rround_number(i);
     rround_double(i);
     rpow_number(i);

js/src/jit/MIR.h

@@ -8944,6 +8944,10 @@ class MFloor
         return congruentIfOperandsEqual(ins);
     }
     void computeRange(TempAllocator &alloc);
+    bool writeRecoverData(CompactBufferWriter &writer) const;
+    bool canRecoverOnBailout() const {
+        return true;
+    }
 };
 
 // Inlined version of Math.ceil().

js/src/jit/Recover.cpp

@@ -509,6 +509,29 @@ RMod::recover(JSContext *cx, SnapshotIterator &iter) const
     return true;
 }
 
+bool
+MFloor::writeRecoverData(CompactBufferWriter &writer) const
+{
+    MOZ_ASSERT(canRecoverOnBailout());
+    writer.writeUnsigned(uint32_t(RInstruction::Recover_Floor));
+    return true;
+}
+
+RFloor::RFloor(CompactBufferReader &reader)
+{ }
+
+bool RFloor::recover(JSContext *cx, SnapshotIterator &iter) const
+{
+    RootedValue v(cx, iter.read());
+    RootedValue result(cx);
+
+    if (!js::math_floor_handle(cx, v, &result))
+        return false;
+
+    iter.storeInstructionResult(result);
+    return true;
+}
+
 bool
 MRound::writeRecoverData(CompactBufferWriter &writer) const
 {

js/src/jit/Recover.h

@@ -31,6 +31,7 @@ namespace jit {
     _(Div)                                      \
     _(Mod)                                      \
     _(Concat)                                   \
+    _(Floor)                                    \
     _(Round)                                    \
     _(Pow)                                      \
     _(NewObject)                                \
@@ -270,6 +271,18 @@ class RConcat MOZ_FINAL : public RInstruction
     bool recover(JSContext *cx, SnapshotIterator &iter) const;
 };
 
+class RFloor MOZ_FINAL : public RInstruction
+{
+  public:
+    RINSTRUCTION_HEADER_(Floor)
+
+    virtual uint32_t numOperands() const {
+        return 1;
+    }
+
+    bool recover(JSContext *cx, SnapshotIterator &iter) const;
+};
+
 class RRound MOZ_FINAL : public RInstruction
 {
   public:

js/src/jsmath.cpp

@@ -424,6 +424,19 @@ js::math_floor_impl(double x)
     return floor(x);
 }
 
+bool
+js::math_floor_handle(JSContext *cx, HandleValue v, MutableHandleValue r)
+{
+    double d;
+    if(!ToNumber(cx, v, &d))
+        return false;
+
+    double z = math_floor_impl(d);
+    r.setNumber(z);
+
+    return true;
+}
+
 bool
 js::math_floor(JSContext *cx, unsigned argc, Value *vp)
 {
@@ -434,13 +447,7 @@ js::math_floor(JSContext *cx, unsigned argc, Value *vp)
         return true;
     }
 
-    double x;
-    if (!ToNumber(cx, args[0], &x))
-        return false;
-
-    double z = math_floor_impl(x);
-    args.rval().setNumber(z);
-    return true;
+    return math_floor_handle(cx, args[0], args.rval());
 }
 
 bool

js/src/jsmath.h

@@ -271,6 +271,9 @@ math_ceil_impl(double x);
 extern bool
 math_clz32(JSContext *cx, unsigned argc, Value *vp);
 
+extern bool
+math_floor_handle(JSContext *cx, HandleValue v, MutableHandleValue r);
+
 extern bool
 math_floor(JSContext *cx, unsigned argc, Value *vp);