Bug 1011539 - Implement Sub Recover instruction. r=nbp

js/src/jit-test/tests/ion/dce-with-rinstructions.js

@@ -163,6 +163,35 @@ function radd_object(i) {
     return i;
 }
 
+var uceFault_sub_number = eval(uneval(uceFault).replace('uceFault', 'uceFault_sub_number'));
+function rsub_number(i) {
+    var x = 1 - i;
+    if (uceFault_sub_number(i) || uceFault_sub_number(i))
+        assertEq(x, -98  /* = 1 - 99 */);
+    return i;
+}
+
+var uceFault_sub_float = eval(uneval(uceFault).replace('uceFault', 'uceFault_sub_float'));
+function rsub_float(i) {
+    var t = Math.fround(1/3);
+    var fi = Math.fround(i);
+    var x = Math.fround(Math.fround(Math.fround(Math.fround(t - fi) - t) - fi) - t);
+    if (uceFault_sub_float(i) || uceFault_sub_float(i))
+        assertEq(x, -198.3333282470703); /* != -198.33333334326744 (when computed with double subtractions) */
+    return i;
+}
+
+var uceFault_sub_object = eval(uneval(uceFault).replace('uceFault', 'uceFault_sub_object'));
+function rsub_object(i) {
+    var t = i;
+    var o = { valueOf: function () { return t; } };
+    var x = o - i; /* computed with t == i, not 1000 */
+    t = 1000;
+    if (uceFault_sub_object(i) || uceFault_sub_object(i))
+        assertEq(x, 0);
+    return i;
+}
+
 for (i = 0; i < 100; i++) {
     rbitnot_number(i);
     rbitnot_object(i);
@@ -180,6 +209,9 @@ for (i = 0; i < 100; i++) {
     radd_float(i);
     radd_string(i);
     radd_object(i);
+    rsub_number(i);
+    rsub_float(i);
+    rsub_object(i);
 }
 
 // Test that we can refer multiple time to the same recover instruction, as well

js/src/jit/MIR.h

@@ -4300,6 +4300,11 @@ class MSub : public MBinaryArithInstruction
     void computeRange(TempAllocator &alloc);
     bool truncate(TruncateKind kind);
     TruncateKind operandTruncateKind(size_t index) const;
+
+    bool writeRecoverData(CompactBufferWriter &writer) const;
+    bool canRecoverOnBailout() const {
+        return specialization_ != MIRType_None;
+    }
 };
 
 class MMul : public MBinaryArithInstruction

js/src/jit/Recover.cpp

@@ -330,6 +330,40 @@ RAdd::recover(JSContext *cx, SnapshotIterator &iter) const
     return true;
 }
 
+bool
+MSub::writeRecoverData(CompactBufferWriter &writer) const
+{
+    MOZ_ASSERT(canRecoverOnBailout());
+    writer.writeUnsigned(uint32_t(RInstruction::Recover_Sub));
+    writer.writeByte(specialization_ == MIRType_Float32);
+    return true;
+}
+
+RSub::RSub(CompactBufferReader &reader)
+{
+    isFloatOperation_ = reader.readByte();
+}
+
+bool
+RSub::recover(JSContext *cx, SnapshotIterator &iter) const
+{
+    RootedValue lhs(cx, iter.read());
+    RootedValue rhs(cx, iter.read());
+    RootedValue result(cx);
+
+    MOZ_ASSERT(!lhs.isObject() && !rhs.isObject());
+    if (!js::SubValues(cx, &lhs, &rhs, &result))
+        return false;
+
+    // MIRType_Float32 is a specialization embedding the fact that the result is
+    // rounded to a Float32.
+    if (isFloatOperation_ && !RoundFloat32(cx, result, &result))
+        return false;
+
+    iter.storeInstructionResult(result);
+    return true;
+}
+
 bool
 MNewObject::writeRecoverData(CompactBufferWriter &writer) const
 {

js/src/jit/Recover.h

@@ -25,6 +25,7 @@ namespace jit {
     _(Rsh)                                      \
     _(Ursh)                                     \
     _(Add)                                      \
+    _(Sub)                                      \
     _(NewObject)                                \
     _(NewDerivedTypedObject)
 
@@ -181,6 +182,21 @@ class RAdd MOZ_FINAL : public RInstruction
     bool recover(JSContext *cx, SnapshotIterator &iter) const;
 };
 
+class RSub MOZ_FINAL : public RInstruction
+{
+  private:
+    bool isFloatOperation_;
+
+  public:
+    RINSTRUCTION_HEADER_(Sub)
+
+    virtual uint32_t numOperands() const {
+        return 2;
+    }
+
+    bool recover(JSContext *cx, SnapshotIterator &iter) const;
+};
+
 class RNewObject MOZ_FINAL : public RInstruction
 {
   private: