Bug 1024896 - IonMonkey: Implement Round Recover Instruction. r=nbp

js/src/jit-test/tests/ion/dce-with-rinstructions.js

@@ -163,6 +163,14 @@ function radd_float(i) {
     return i;
 }
 
+var uceFault_round = eval(uneval(uceFault).replace('uceFault', 'uceFault_round'));
+function rround_number(i) {
+    var x = Math.round(i + 1.4);
+    if (uceFault_round(i) || uceFault_round(i))
+        assertEq(x, 100); /* = i + 1*/
+    return i;
+}
+
 var uceFault_add_object = eval(uneval(uceFault).replace('uceFault', 'uceFault_add_object'));
 function radd_object(i) {
     var t = i;
@@ -327,6 +335,7 @@ for (i = 0; i < 100; i++) {
     rmod_object(i);
     rconcat_string(i);
     rconcat_number(i);
+    rround_number(i);
 }
 
 // Test that we can refer multiple time to the same recover instruction, as well

js/src/jit/MIR.h

@@ -9023,6 +9023,11 @@ class MRound
     bool congruentTo(const MDefinition *ins) const {
         return congruentIfOperandsEqual(ins);
     }
+
+    bool writeRecoverData(CompactBufferWriter &writer) const;
+    bool canRecoverOnBailout() const {
+        return true;
+    }
 };
 
 class MIteratorStart

js/src/jit/Recover.cpp

@@ -509,6 +509,31 @@ RMod::recover(JSContext *cx, SnapshotIterator &iter) const
 	return true;
 }
 
+bool
+MRound::writeRecoverData(CompactBufferWriter &writer) const
+{
+    MOZ_ASSERT(canRecoverOnBailout());
+    writer.writeUnsigned(uint32_t(RInstruction::Recover_Round));
+    return true;
+}
+
+RRound::RRound(CompactBufferReader &reader)
+{}
+
+bool
+RRound::recover(JSContext *cx, SnapshotIterator &iter) const
+{
+    RootedValue arg(cx, iter.read());
+    RootedValue result(cx);
+
+    MOZ_ASSERT(!arg.isObject());
+    if(!js::math_round_handle(cx, arg, &result))
+        return false;
+
+    iter.storeInstructionResult(result);
+    return true;
+}
+
 bool
 MNewObject::writeRecoverData(CompactBufferWriter &writer) const
 {

js/src/jit/Recover.h

@@ -31,6 +31,7 @@ namespace jit {
     _(Div)                                      \
     _(Mod)                                      \
     _(Concat)                                   \
+    _(Round)                                    \
     _(NewObject)                                \
     _(NewDerivedTypedObject)
 
@@ -268,6 +269,18 @@ class RConcat MOZ_FINAL : public RInstruction
     bool recover(JSContext *cx, SnapshotIterator &iter) const;
 };
 
+class RRound MOZ_FINAL : public RInstruction
+{
+  public:
+    RINSTRUCTION_HEADER_(Round)
+
+    virtual uint32_t numOperands() const {
+        return 1;
+    }
+
+    bool recover(JSContext *cx, SnapshotIterator &iter) const;
+};
+
 class RNewObject MOZ_FINAL : public RInstruction
 {
   private:

js/src/jsmath.cpp

@@ -776,6 +776,18 @@ js_math_random(JSContext *cx, unsigned argc, Value *vp)
     return true;
 }
 
+bool
+js::math_round_handle(JSContext *cx, HandleValue arg, MutableHandleValue res)
+{
+    double d;
+    if (!ToNumber(cx, arg, &d))
+        return false;
+
+    d = math_round_impl(d);
+    res.setNumber(d);
+    return true;
+}
+
 double
 js::math_round_impl(double x)
 {
@@ -814,13 +826,7 @@ js::math_round(JSContext *cx, unsigned argc, Value *vp)
         return true;
     }
 
-    double x;
-    if (!ToNumber(cx, args[0], &x))
-        return false;
-
-    double z = math_round_impl(x);
-    args.rval().setNumber(z);
-    return true;
+    return js::math_round_handle(cx, args[0], args.rval());
 }
 
 double

js/src/jsmath.h

@@ -274,6 +274,9 @@ math_floor(JSContext *cx, unsigned argc, Value *vp);
 extern double
 math_floor_impl(double x);
 
+extern bool
+math_round_handle(JSContext *cx, HandleValue arg, MutableHandleValue res);
+
 extern bool
 math_round(JSContext *cx, unsigned argc, Value *vp);