Bug 876398 - Compile JSOP_POPN with Baseline and Ion. r=djvj

js/src/ion/BaselineCompiler.cpp

@@ -623,6 +623,13 @@ BaselineCompiler::emit_JSOP_POP()
     return true;
 }
 
+bool
+BaselineCompiler::emit_JSOP_POPN()
+{
+    frame.popn(GET_UINT16(pc));
+    return true;
+}
+
 bool
 BaselineCompiler::emit_JSOP_DUP()
 {

js/src/ion/BaselineCompiler.h

@@ -35,6 +35,7 @@ namespace ion {
     _(JSOP_LABEL)              \
     _(JSOP_NOTEARG)            \
     _(JSOP_POP)                \
+    _(JSOP_POPN)               \
     _(JSOP_DUP)                \
     _(JSOP_DUP2)               \
     _(JSOP_SWAP)               \

js/src/ion/IonBuilder.cpp

@@ -1244,6 +1244,11 @@ IonBuilder::inspectOpcode(JSOp op)
             return true;
         return maybeInsertResume();
 
+      case JSOP_POPN:
+        for (uint32_t i = 0, n = GET_UINT16(pc); i < n; i++)
+            current->pop();
+        return true;
+
       case JSOP_NEWINIT:
       {
         if (GET_UINT8(pc) == JSProto_Array)

js/src/jit-test/tests/ion/popn.js

@@ -0,0 +1,11 @@
+function f() {
+    var t = 0;
+    for (var j = 0; j < 10; j++) {
+	for (var i = 0; i < 9; ++i) {
+            var [r, g, b] = [1, i, -10];
+            t += r + g + b;
+	}
+    }
+    return t;
+}
+assertEq(f(), -450);