Backout a9cfcf4b62d9 (bug 803730), a5e214d4f8b0 (bug 803730), for intermittent oranges in newly added tests

js/src/ion/CodeGenerator.cpp

@@ -4027,27 +4027,17 @@ CodeGenerator::emitInstanceOf(LInstruction *ins, Register rhs)
     Register rhsFlags = ToRegister(ins->getTemp(0));
     Register lhsTmp = ToRegister(ins->getTemp(0));
 
+    Label callHasInstance;
     Label boundFunctionCheck;
     Label boundFunctionDone;
     Label done;
     Label loopPrototypeChain;
 
-    JS_ASSERT(ins->isInstanceOfO() || ins->isInstanceOfV());
-    bool lhsIsValue = ins->isInstanceOfV();
-
     typedef bool (*pf)(JSContext *, HandleObject, HandleValue, JSBool *);
     static const VMFunction HasInstanceInfo = FunctionInfo<pf>(js::HasInstance);
 
-    // If the lhs is an object, then the ValueOperand that gets sent to
-    // HasInstance must be boxed first.  If the lhs is a value, it can
-    // be sent directly.  Hence the choice between ToValue and ToTempValue
-    // below.  Note that the same check is done below in the generated code
-    // and explicit boxing instructions emitted before calling the OOL code
-    // if we're handling a LInstanceOfO.
-
-    OutOfLineCode *call = oolCallVM(HasInstanceInfo, ins,
-        (ArgList(), rhs, lhsIsValue ? ToValue(ins, 0) : ToTempValue(ins, 0)),
-        StoreRegisterTo(output));
+    OutOfLineCode *call = oolCallVM(HasInstanceInfo, ins, (ArgList(), rhs, ToValue(ins, 0)),
+                                   StoreRegisterTo(output));
     if (!call)
         return false;
 
@@ -4069,18 +4059,7 @@ CodeGenerator::emitInstanceOf(LInstruction *ins, Register rhs)
 
     masm.loadBaseShape(rhsTmp, output);
     masm.cmpPtr(Address(output, BaseShape::offsetOfClass()), ImmWord(&js::FunctionClass));
-    if (lhsIsValue) {
-        // If the input LHS is a value, no boxing necessary.
-        masm.j(Assembler::NotEqual, call->entry());
-    } else {
-        // If the input LHS is raw object pointer, it must be boxed before
-        // calling into js::HasInstance.
-        Label dontCallHasInstance;
-        masm.j(Assembler::Equal, &dontCallHasInstance);
-        masm.boxNonDouble(JSVAL_TYPE_OBJECT, ToRegister(ins->getOperand(0)), ToTempValue(ins, 0));
-        masm.jump(call->entry());
-        masm.bind(&dontCallHasInstance);
-    }
+    masm.j(Assembler::NotEqual, call->entry());
 
     // Check Bound Function
     masm.loadPtr(Address(output, BaseShape::offsetOfFlags()), rhsFlags);
@@ -4114,7 +4093,7 @@ CodeGenerator::emitInstanceOf(LInstruction *ins, Register rhs)
     // When lhs is a value: The HasInstance for function objects always
     // return false when lhs isn't an object. So check if
     // lhs is an object and otherwise return false
-    if (lhsIsValue) {
+    if (ins->isInstanceOfV()) {
         Label isObject;
         ValueOperand lhsValue = ToValue(ins, LInstanceOfV::LHS);
         masm.branchTestObject(Assembler::Equal, lhsValue, &isObject);
@@ -4153,17 +4132,7 @@ CodeGenerator::emitInstanceOf(LInstruction *ins, Register rhs)
     masm.loadPtr(Address(lhsTmp, offsetof(types::TypeObject, proto)), lhsTmp);
 
     // Bail out if we hit a lazy proto
-    if (lhsIsValue) {
-        masm.branch32(Assembler::Equal, lhsTmp, Imm32(1), call->entry());
-    } else {
-        // If the input LHS is raw object pointer, it must be boxed before
-        // calling into js::HasInstance.
-        Label dontCallHasInstance;
-        masm.branch32(Assembler::NotEqual, lhsTmp, Imm32(1), &dontCallHasInstance);
-        masm.boxNonDouble(JSVAL_TYPE_OBJECT, ToRegister(ins->getOperand(0)), ToTempValue(ins, 0));
-        masm.jump(call->entry());
-        masm.bind(&dontCallHasInstance);
-    }
+    masm.branch32(Assembler::Equal, lhsTmp, Imm32(1), call->entry());
 
     masm.testPtr(lhsTmp, lhsTmp);
     masm.j(Assembler::Zero, &done);

js/src/ion/arm/CodeGenerator-arm.cpp

@@ -1029,14 +1029,6 @@ CodeGeneratorARM::ToOutValue(LInstruction *ins)
     return ValueOperand(typeReg, payloadReg);
 }
 
-ValueOperand
-CodeGeneratorARM::ToTempValue(LInstruction *ins, size_t pos)
-{
-    Register typeReg = ToRegister(ins->getTemp(pos + TYPE_INDEX));
-    Register payloadReg = ToRegister(ins->getTemp(pos + PAYLOAD_INDEX));
-    return ValueOperand(typeReg, payloadReg);
-}
-
 bool
 CodeGeneratorARM::visitValue(LValue *value)
 {

js/src/ion/arm/CodeGenerator-arm.h

@@ -110,7 +110,6 @@ class CodeGeneratorARM : public CodeGeneratorShared
   protected:
     ValueOperand ToValue(LInstruction *ins, size_t pos);
     ValueOperand ToOutValue(LInstruction *ins);
-    ValueOperand ToTempValue(LInstruction *ins, size_t pos);
 
     // Functions for LTestVAndBranch.
     Register splitTagForTest(const ValueOperand &value);

js/src/ion/arm/MacroAssembler-arm.cpp

@@ -2235,12 +2235,6 @@ MacroAssemblerARMCompat::boxDouble(const FloatRegister &src, const ValueOperand
     as_vxfer(dest.payloadReg(), dest.typeReg(), VFPRegister(src), FloatToCore);
 }
 
-void
-MacroAssemblerARMCompat::boxNonDouble(JSValueType type, const Register &src, const ValueOperand &dest) {
-    if (src != dest.payloadReg())
-        ma_mov(src, dest.payloadReg());
-    ma_mov(Imm32(type), dest.typeReg());
-}
 
 void
 MacroAssemblerARMCompat::boolValueToDouble(const ValueOperand &operand, const FloatRegister &dest)

js/src/ion/arm/MacroAssembler-arm.h

@@ -549,7 +549,6 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
 
     // boxing code
     void boxDouble(const FloatRegister &src, const ValueOperand &dest);
-    void boxNonDouble(JSValueType type, const Register &src, const ValueOperand &dest);
 
     // Extended unboxing API. If the payload is already in a register, returns
     // that register. Otherwise, provides a move to the given scratch register,

js/src/ion/x64/CodeGenerator-x64.cpp

@@ -33,12 +33,6 @@ CodeGeneratorX64::ToOutValue(LInstruction *ins)
     return ValueOperand(ToRegister(ins->getDef(0)));
 }
 
-ValueOperand
-CodeGeneratorX64::ToTempValue(LInstruction *ins, size_t pos)
-{
-    return ValueOperand(ToRegister(ins->getTemp(pos)));
-}
-
 bool
 CodeGeneratorX64::visitDouble(LDouble *ins)
 {

js/src/ion/x64/CodeGenerator-x64.h

@@ -23,7 +23,6 @@ class CodeGeneratorX64 : public CodeGeneratorX86Shared
   protected:
     ValueOperand ToValue(LInstruction *ins, size_t pos);
     ValueOperand ToOutValue(LInstruction *ins);
-    ValueOperand ToTempValue(LInstruction *ins, size_t pos);
 
 
     void loadUnboxedValue(Operand source, MIRType type, const LDefinition *dest);

js/src/ion/x64/MacroAssembler-x64.h

@@ -647,10 +647,6 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
     void boxDouble(const FloatRegister &src, const ValueOperand &dest) {
         movqsd(src, dest.valueReg());
     }
-    void boxNonDouble(JSValueType type, const Register &src, const ValueOperand &dest) {
-        JS_ASSERT(src != dest.valueReg());
-        boxValue(type, src, dest.valueReg());
-    }
 
     // Note that the |dest| register here may be ScratchReg, so we shouldn't
     // use it.

js/src/ion/x86/CodeGenerator-x86.cpp

@@ -68,14 +68,6 @@ CodeGeneratorX86::ToOutValue(LInstruction *ins)
     return ValueOperand(typeReg, payloadReg);
 }
 
-ValueOperand
-CodeGeneratorX86::ToTempValue(LInstruction *ins, size_t pos)
-{
-    Register typeReg = ToRegister(ins->getTemp(pos + TYPE_INDEX));
-    Register payloadReg = ToRegister(ins->getTemp(pos + PAYLOAD_INDEX));
-    return ValueOperand(typeReg, payloadReg);
-}
-
 bool
 CodeGeneratorX86::visitValue(LValue *value)
 {

js/src/ion/x86/CodeGenerator-x86.h

@@ -43,7 +43,6 @@ class CodeGeneratorX86 : public CodeGeneratorX86Shared
   protected:
     ValueOperand ToValue(LInstruction *ins, size_t pos);
     ValueOperand ToOutValue(LInstruction *ins);
-    ValueOperand ToTempValue(LInstruction *ins, size_t pos);
 
     void storeElementTyped(const LAllocation *value, MIRType valueType, MIRType elementType,
                            const Register &elements, const LAllocation *index);

js/src/ion/x86/MacroAssembler-x86.h

@@ -533,11 +533,6 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
         psrldq(Imm32(4), src);
         movd(src, dest.typeReg());
     }
-    void boxNonDouble(JSValueType type, const Register &src, const ValueOperand &dest) {
-        if (src != dest.payloadReg())
-            movl(src, dest.payloadReg());
-        movl(Imm32(type), dest.typeReg());
-    }
     void unboxInt32(const ValueOperand &src, const Register &dest) {
         movl(src.payloadReg(), dest);
     }

js/xpconnect/tests/mochitest/Makefile.in

@@ -85,7 +85,6 @@ MOCHITEST_FILES =	chrome_wrappers_helper.html \
 		file_bug795275.xml \
 		file_bug799348.html \
 		test_bug800864.html \
-		test_bug803730.html \
 		$(NULL)
 
 ifneq ($(OS_TARGET),Android)

js/xpconnect/tests/mochitest/test_bug803730.html

@@ -1,36 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=803730
--->
-<head>
-  <meta charset="utf-8">
-  <title>Test for Bug 803730</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=803730">Mozilla Bug 803730</a>
-<p id="display"></p>
-<div id="content" style="display: none">
-</div>
-<pre id="test">
-<script type="application/javascript">
-
-/** Test for Bug 803730 **/
-function IsNode(obj) {
-    return !!(obj instanceof Node);
-}
-
-var elem = document.createElement("span");
-var falseCount = 0;
-for (var x = 0; x < 100000; x++) {
-  if (!IsNode(elem))
-    falseCount++;
-}
-is(falseCount, 0, "elem instanceof Node working correctly.");
-
-</script>
-</pre>
-</body>
-</html>