From 57e1984f1b68b6e5f229aa589c5ceef3e8e923ff Mon Sep 17 00:00:00 2001
From: Nathan Froyd <froydnj@mozilla.com>
Date: Wed, 7 Nov 2012 14:58:29 -0500
Subject: [PATCH] Backout a9cfcf4b62d9 (bug 803730), a5e214d4f8b0 (bug 803730),
 for intermittent oranges in newly added tests

---
 js/src/ion/CodeGenerator.cpp                  | 43 +++----------------
 js/src/ion/arm/CodeGenerator-arm.cpp          |  8 ----
 js/src/ion/arm/CodeGenerator-arm.h            |  1 -
 js/src/ion/arm/MacroAssembler-arm.cpp         |  6 ---
 js/src/ion/arm/MacroAssembler-arm.h           |  1 -
 js/src/ion/x64/CodeGenerator-x64.cpp          |  6 ---
 js/src/ion/x64/CodeGenerator-x64.h            |  1 -
 js/src/ion/x64/MacroAssembler-x64.h           |  4 --
 js/src/ion/x86/CodeGenerator-x86.cpp          |  8 ----
 js/src/ion/x86/CodeGenerator-x86.h            |  1 -
 js/src/ion/x86/MacroAssembler-x86.h           |  5 ---
 js/xpconnect/tests/mochitest/Makefile.in      |  1 -
 .../tests/mochitest/test_bug803730.html       | 36 ----------------
 13 files changed, 6 insertions(+), 115 deletions(-)
 delete mode 100644 js/xpconnect/tests/mochitest/test_bug803730.html

diff --git a/js/src/ion/CodeGenerator.cpp b/js/src/ion/CodeGenerator.cpp
index 5e5c90c80e0..14d9ef17ef1 100644
--- a/js/src/ion/CodeGenerator.cpp
+++ b/js/src/ion/CodeGenerator.cpp
@@ -4027,27 +4027,17 @@ CodeGenerator::emitInstanceOf(LInstruction *ins, Register rhs)
     Register rhsFlags = ToRegister(ins->getTemp(0));
     Register lhsTmp = ToRegister(ins->getTemp(0));
 
+    Label callHasInstance;
     Label boundFunctionCheck;
     Label boundFunctionDone;
     Label done;
     Label loopPrototypeChain;
 
-    JS_ASSERT(ins->isInstanceOfO() || ins->isInstanceOfV());
-    bool lhsIsValue = ins->isInstanceOfV();
-
     typedef bool (*pf)(JSContext *, HandleObject, HandleValue, JSBool *);
     static const VMFunction HasInstanceInfo = FunctionInfo<pf>(js::HasInstance);
 
-    // If the lhs is an object, then the ValueOperand that gets sent to
-    // HasInstance must be boxed first.  If the lhs is a value, it can
-    // be sent directly.  Hence the choice between ToValue and ToTempValue
-    // below.  Note that the same check is done below in the generated code
-    // and explicit boxing instructions emitted before calling the OOL code
-    // if we're handling a LInstanceOfO.
-
-    OutOfLineCode *call = oolCallVM(HasInstanceInfo, ins,
-        (ArgList(), rhs, lhsIsValue ? ToValue(ins, 0) : ToTempValue(ins, 0)),
-        StoreRegisterTo(output));
+    OutOfLineCode *call = oolCallVM(HasInstanceInfo, ins, (ArgList(), rhs, ToValue(ins, 0)),
+                                   StoreRegisterTo(output));
     if (!call)
         return false;
 
@@ -4069,18 +4059,7 @@ CodeGenerator::emitInstanceOf(LInstruction *ins, Register rhs)
 
     masm.loadBaseShape(rhsTmp, output);
     masm.cmpPtr(Address(output, BaseShape::offsetOfClass()), ImmWord(&js::FunctionClass));
-    if (lhsIsValue) {
-        // If the input LHS is a value, no boxing necessary.
-        masm.j(Assembler::NotEqual, call->entry());
-    } else {
-        // If the input LHS is raw object pointer, it must be boxed before
-        // calling into js::HasInstance.
-        Label dontCallHasInstance;
-        masm.j(Assembler::Equal, &dontCallHasInstance);
-        masm.boxNonDouble(JSVAL_TYPE_OBJECT, ToRegister(ins->getOperand(0)), ToTempValue(ins, 0));
-        masm.jump(call->entry());
-        masm.bind(&dontCallHasInstance);
-    }
+    masm.j(Assembler::NotEqual, call->entry());
 
     // Check Bound Function
     masm.loadPtr(Address(output, BaseShape::offsetOfFlags()), rhsFlags);
@@ -4114,7 +4093,7 @@ CodeGenerator::emitInstanceOf(LInstruction *ins, Register rhs)
     // When lhs is a value: The HasInstance for function objects always
     // return false when lhs isn't an object. So check if
     // lhs is an object and otherwise return false
-    if (lhsIsValue) {
+    if (ins->isInstanceOfV()) {
         Label isObject;
         ValueOperand lhsValue = ToValue(ins, LInstanceOfV::LHS);
         masm.branchTestObject(Assembler::Equal, lhsValue, &isObject);
@@ -4153,17 +4132,7 @@ CodeGenerator::emitInstanceOf(LInstruction *ins, Register rhs)
     masm.loadPtr(Address(lhsTmp, offsetof(types::TypeObject, proto)), lhsTmp);
 
     // Bail out if we hit a lazy proto
-    if (lhsIsValue) {
-        masm.branch32(Assembler::Equal, lhsTmp, Imm32(1), call->entry());
-    } else {
-        // If the input LHS is raw object pointer, it must be boxed before
-        // calling into js::HasInstance.
-        Label dontCallHasInstance;
-        masm.branch32(Assembler::NotEqual, lhsTmp, Imm32(1), &dontCallHasInstance);
-        masm.boxNonDouble(JSVAL_TYPE_OBJECT, ToRegister(ins->getOperand(0)), ToTempValue(ins, 0));
-        masm.jump(call->entry());
-        masm.bind(&dontCallHasInstance);
-    }
+    masm.branch32(Assembler::Equal, lhsTmp, Imm32(1), call->entry());
 
     masm.testPtr(lhsTmp, lhsTmp);
     masm.j(Assembler::Zero, &done);
diff --git a/js/src/ion/arm/CodeGenerator-arm.cpp b/js/src/ion/arm/CodeGenerator-arm.cpp
index 97cd7d6321f..0dbce9f5326 100644
--- a/js/src/ion/arm/CodeGenerator-arm.cpp
+++ b/js/src/ion/arm/CodeGenerator-arm.cpp
@@ -1029,14 +1029,6 @@ CodeGeneratorARM::ToOutValue(LInstruction *ins)
     return ValueOperand(typeReg, payloadReg);
 }
 
-ValueOperand
-CodeGeneratorARM::ToTempValue(LInstruction *ins, size_t pos)
-{
-    Register typeReg = ToRegister(ins->getTemp(pos + TYPE_INDEX));
-    Register payloadReg = ToRegister(ins->getTemp(pos + PAYLOAD_INDEX));
-    return ValueOperand(typeReg, payloadReg);
-}
-
 bool
 CodeGeneratorARM::visitValue(LValue *value)
 {
diff --git a/js/src/ion/arm/CodeGenerator-arm.h b/js/src/ion/arm/CodeGenerator-arm.h
index 779b46acf54..94c9772ef33 100644
--- a/js/src/ion/arm/CodeGenerator-arm.h
+++ b/js/src/ion/arm/CodeGenerator-arm.h
@@ -110,7 +110,6 @@ class CodeGeneratorARM : public CodeGeneratorShared
   protected:
     ValueOperand ToValue(LInstruction *ins, size_t pos);
     ValueOperand ToOutValue(LInstruction *ins);
-    ValueOperand ToTempValue(LInstruction *ins, size_t pos);
 
     // Functions for LTestVAndBranch.
     Register splitTagForTest(const ValueOperand &value);
diff --git a/js/src/ion/arm/MacroAssembler-arm.cpp b/js/src/ion/arm/MacroAssembler-arm.cpp
index e372a2233aa..2d1c0aa9f51 100644
--- a/js/src/ion/arm/MacroAssembler-arm.cpp
+++ b/js/src/ion/arm/MacroAssembler-arm.cpp
@@ -2235,12 +2235,6 @@ MacroAssemblerARMCompat::boxDouble(const FloatRegister &src, const ValueOperand
     as_vxfer(dest.payloadReg(), dest.typeReg(), VFPRegister(src), FloatToCore);
 }
 
-void
-MacroAssemblerARMCompat::boxNonDouble(JSValueType type, const Register &src, const ValueOperand &dest) {
-    if (src != dest.payloadReg())
-        ma_mov(src, dest.payloadReg());
-    ma_mov(Imm32(type), dest.typeReg());
-}
 
 void
 MacroAssemblerARMCompat::boolValueToDouble(const ValueOperand &operand, const FloatRegister &dest)
diff --git a/js/src/ion/arm/MacroAssembler-arm.h b/js/src/ion/arm/MacroAssembler-arm.h
index 95ead8c5150..05fcb951395 100644
--- a/js/src/ion/arm/MacroAssembler-arm.h
+++ b/js/src/ion/arm/MacroAssembler-arm.h
@@ -549,7 +549,6 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
 
     // boxing code
     void boxDouble(const FloatRegister &src, const ValueOperand &dest);
-    void boxNonDouble(JSValueType type, const Register &src, const ValueOperand &dest);
 
     // Extended unboxing API. If the payload is already in a register, returns
     // that register. Otherwise, provides a move to the given scratch register,
diff --git a/js/src/ion/x64/CodeGenerator-x64.cpp b/js/src/ion/x64/CodeGenerator-x64.cpp
index 4f3b0a7dfe2..6d0edf53686 100644
--- a/js/src/ion/x64/CodeGenerator-x64.cpp
+++ b/js/src/ion/x64/CodeGenerator-x64.cpp
@@ -33,12 +33,6 @@ CodeGeneratorX64::ToOutValue(LInstruction *ins)
     return ValueOperand(ToRegister(ins->getDef(0)));
 }
 
-ValueOperand
-CodeGeneratorX64::ToTempValue(LInstruction *ins, size_t pos)
-{
-    return ValueOperand(ToRegister(ins->getTemp(pos)));
-}
-
 bool
 CodeGeneratorX64::visitDouble(LDouble *ins)
 {
diff --git a/js/src/ion/x64/CodeGenerator-x64.h b/js/src/ion/x64/CodeGenerator-x64.h
index dfd368f9956..d08e34968f2 100644
--- a/js/src/ion/x64/CodeGenerator-x64.h
+++ b/js/src/ion/x64/CodeGenerator-x64.h
@@ -23,7 +23,6 @@ class CodeGeneratorX64 : public CodeGeneratorX86Shared
   protected:
     ValueOperand ToValue(LInstruction *ins, size_t pos);
     ValueOperand ToOutValue(LInstruction *ins);
-    ValueOperand ToTempValue(LInstruction *ins, size_t pos);
 
 
     void loadUnboxedValue(Operand source, MIRType type, const LDefinition *dest);
diff --git a/js/src/ion/x64/MacroAssembler-x64.h b/js/src/ion/x64/MacroAssembler-x64.h
index 572ab1c2144..368d158d49a 100644
--- a/js/src/ion/x64/MacroAssembler-x64.h
+++ b/js/src/ion/x64/MacroAssembler-x64.h
@@ -647,10 +647,6 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
     void boxDouble(const FloatRegister &src, const ValueOperand &dest) {
         movqsd(src, dest.valueReg());
     }
-    void boxNonDouble(JSValueType type, const Register &src, const ValueOperand &dest) {
-        JS_ASSERT(src != dest.valueReg());
-        boxValue(type, src, dest.valueReg());
-    }
 
     // Note that the |dest| register here may be ScratchReg, so we shouldn't
     // use it.
diff --git a/js/src/ion/x86/CodeGenerator-x86.cpp b/js/src/ion/x86/CodeGenerator-x86.cpp
index 149e97a0011..8f2cc2c5791 100644
--- a/js/src/ion/x86/CodeGenerator-x86.cpp
+++ b/js/src/ion/x86/CodeGenerator-x86.cpp
@@ -68,14 +68,6 @@ CodeGeneratorX86::ToOutValue(LInstruction *ins)
     return ValueOperand(typeReg, payloadReg);
 }
 
-ValueOperand
-CodeGeneratorX86::ToTempValue(LInstruction *ins, size_t pos)
-{
-    Register typeReg = ToRegister(ins->getTemp(pos + TYPE_INDEX));
-    Register payloadReg = ToRegister(ins->getTemp(pos + PAYLOAD_INDEX));
-    return ValueOperand(typeReg, payloadReg);
-}
-
 bool
 CodeGeneratorX86::visitValue(LValue *value)
 {
diff --git a/js/src/ion/x86/CodeGenerator-x86.h b/js/src/ion/x86/CodeGenerator-x86.h
index af484fa0029..2069ebad4b0 100644
--- a/js/src/ion/x86/CodeGenerator-x86.h
+++ b/js/src/ion/x86/CodeGenerator-x86.h
@@ -43,7 +43,6 @@ class CodeGeneratorX86 : public CodeGeneratorX86Shared
   protected:
     ValueOperand ToValue(LInstruction *ins, size_t pos);
     ValueOperand ToOutValue(LInstruction *ins);
-    ValueOperand ToTempValue(LInstruction *ins, size_t pos);
 
     void storeElementTyped(const LAllocation *value, MIRType valueType, MIRType elementType,
                            const Register &elements, const LAllocation *index);
diff --git a/js/src/ion/x86/MacroAssembler-x86.h b/js/src/ion/x86/MacroAssembler-x86.h
index 90f9838f90e..8b240622671 100644
--- a/js/src/ion/x86/MacroAssembler-x86.h
+++ b/js/src/ion/x86/MacroAssembler-x86.h
@@ -533,11 +533,6 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
         psrldq(Imm32(4), src);
         movd(src, dest.typeReg());
     }
-    void boxNonDouble(JSValueType type, const Register &src, const ValueOperand &dest) {
-        if (src != dest.payloadReg())
-            movl(src, dest.payloadReg());
-        movl(Imm32(type), dest.typeReg());
-    }
     void unboxInt32(const ValueOperand &src, const Register &dest) {
         movl(src.payloadReg(), dest);
     }
diff --git a/js/xpconnect/tests/mochitest/Makefile.in b/js/xpconnect/tests/mochitest/Makefile.in
index 52fb41db924..f6160b72b47 100644
--- a/js/xpconnect/tests/mochitest/Makefile.in
+++ b/js/xpconnect/tests/mochitest/Makefile.in
@@ -85,7 +85,6 @@ MOCHITEST_FILES =	chrome_wrappers_helper.html \
 		file_bug795275.xml \
 		file_bug799348.html \
 		test_bug800864.html \
-		test_bug803730.html \
 		$(NULL)
 
 ifneq ($(OS_TARGET),Android)
diff --git a/js/xpconnect/tests/mochitest/test_bug803730.html b/js/xpconnect/tests/mochitest/test_bug803730.html
deleted file mode 100644
index 4e38b00be78..00000000000
--- a/js/xpconnect/tests/mochitest/test_bug803730.html
+++ /dev/null
@@ -1,36 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=803730
--->
-<head>
-  <meta charset="utf-8">
-  <title>Test for Bug 803730</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=803730">Mozilla Bug 803730</a>
-<p id="display"></p>
-<div id="content" style="display: none">
-</div>
-<pre id="test">
-<script type="application/javascript">
-
-/** Test for Bug 803730 **/
-function IsNode(obj) {
-    return !!(obj instanceof Node);
-}
-
-var elem = document.createElement("span");
-var falseCount = 0;
-for (var x = 0; x < 100000; x++) {
-  if (!IsNode(elem))
-    falseCount++;
-}
-is(falseCount, 0, "elem instanceof Node working correctly.");
-
-</script>
-</pre>
-</body>
-</html>