Bug 1066041 - Implement typeof recover instruction. r=nbp

js/src/jit-test/tests/ion/dce-with-rinstructions.js

@@ -911,6 +911,20 @@ function rregexp_m_literal_replace(i) {
     return i;
 }
 
+var uceFault_typeof = eval(uneval(uceFault).replace('uceFault', 'uceFault_typeof'))
+function rtypeof(i) {
+    var inputs = [ {}, [], 1, true, Symbol(), undefined, function(){}, null ];
+    var types = [ "object", "object", "number", "boolean", "symbol", "undefined", "function", "object"];
+    var x = typeof (inputs[i % inputs.length]);
+    var y = types[i % types.length];
+
+    if (uceFault_typeof(i) || uceFault_typeof(i)) {
+        assertEq(x, y);
+    }
+
+    return i;
+}
+
 for (i = 0; i < 100; i++) {
     rbitnot_number(i);
     rbitnot_object(i);
@@ -999,6 +1013,7 @@ for (i = 0; i < 100; i++) {
     rregexp_i_literal_replace(i);
     rregexp_m_replace(i);
     rregexp_m_literal_replace(i);
+    rtypeof(i);
 }
 
 // Test that we can refer multiple time to the same recover instruction, as well

js/src/jit/MIR.h

@@ -4334,6 +4334,11 @@ class MTypeOf
         }
         return congruentIfOperandsEqual(ins);
     }
+
+    bool writeRecoverData(CompactBufferWriter &writer) const;
+    bool canRecoverOnBailout() const {
+        return true;
+    }
 };
 
 class MToId

js/src/jit/Recover.cpp

@@ -963,6 +963,27 @@ RRegExpReplace::recover(JSContext *cx, SnapshotIterator &iter) const
     return true;
 }
 
+bool
+MTypeOf::writeRecoverData(CompactBufferWriter &writer) const
+{
+    MOZ_ASSERT(canRecoverOnBailout());
+    writer.writeUnsigned(uint32_t(RInstruction::Recover_TypeOf));
+    return true;
+}
+
+RTypeOf::RTypeOf(CompactBufferReader &reader)
+{ }
+
+bool
+RTypeOf::recover(JSContext *cx, SnapshotIterator &iter) const
+{
+    RootedValue v(cx, iter.read());
+
+    RootedValue result(cx, StringValue(TypeOfOperation(v, cx->runtime())));
+    iter.storeInstructionResult(result);
+    return true;
+}
+
 bool
 MNewObject::writeRecoverData(CompactBufferWriter &writer) const
 {

js/src/jit/Recover.h

@@ -50,6 +50,7 @@ namespace jit {
     _(RegExpExec)                               \
     _(RegExpTest)                               \
     _(RegExpReplace)                            \
+    _(TypeOf)                                   \
     _(NewObject)                                \
     _(NewArray)                                 \
     _(NewDerivedTypedObject)                    \
@@ -501,6 +502,18 @@ class RRegExpReplace MOZ_FINAL : public RInstruction
     bool recover(JSContext *cx, SnapshotIterator &iter) const;
 };
 
+class RTypeOf MOZ_FINAL : public RInstruction
+{
+  public:
+    RINSTRUCTION_HEADER_(TypeOf)
+
+    virtual uint32_t numOperands() const {
+        return 1;
+    }
+
+    bool recover(JSContext *cx, SnapshotIterator &iter) const;
+};
+
 class RNewObject MOZ_FINAL : public RInstruction
 {
   private: