From ccebbfbc56330e07ee9f72c47dbc2194fe5c6409 Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Wed, 19 Aug 2015 15:15:57 +0200
Subject: [PATCH] Bug 1171945: IonMonkey - Part 6: Use binarystub in
 jsop_binary_arith, r=jandem

---
 js/src/jit/IonBuilder.cpp | 33 +++++++++++++++++++++++++++++++++
 js/src/jit/IonBuilder.h   |  1 +
 2 files changed, 34 insertions(+)

diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 5f723770c8b..b98daf72ae2 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -4671,6 +4671,36 @@ IonBuilder::binaryArithTrySpecializedOnBaselineInspector(bool* emitted, JSOp op,
     return true;
 }
 
+bool
+IonBuilder::binaryArithTrySharedStub(bool* emitted, JSOp op,
+                                     MDefinition* left, MDefinition* right)
+{
+    MOZ_ASSERT(*emitted == false);
+
+    // Try to emit a shared stub cache.
+
+    if (js_JitOptions.disableSharedStubs)
+        return true;
+
+    // It is not possible for shared stubs to impersonate another op.
+    if (JSOp(*pc) != op)
+        return true;
+
+    MBinarySharedStub *stub = MBinarySharedStub::New(alloc(), left, right);
+    current->add(stub);
+    current->push(stub);
+
+    // Decrease type from 'any type' to 'empty type' when one of the operands
+    // is 'empty typed'.
+    maybeMarkEmpty(stub);
+
+    if (!resumeAfter(stub))
+        return false;
+
+    *emitted = true;
+    return true;
+}
+
 bool
 IonBuilder::jsop_binary_arith(JSOp op, MDefinition* left, MDefinition* right)
 {
@@ -4687,6 +4717,9 @@ IonBuilder::jsop_binary_arith(JSOp op, MDefinition* left, MDefinition* right)
             return emitted;
     }
 
+    if (!binaryArithTrySharedStub(&emitted, op, left, right) || emitted)
+        return emitted;
+
     // Not possible to optimize. Do a slow vm call.
     MDefinition::Opcode def_op = JSOpToMDefinition(op);
     MBinaryArithInstruction* ins = MBinaryArithInstruction::New(alloc(), def_op, left, right);
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index b408b457a54..800425c0d6c 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -489,6 +489,7 @@ class IonBuilder
     bool binaryArithTrySpecialized(bool* emitted, JSOp op, MDefinition* left, MDefinition* right);
     bool binaryArithTrySpecializedOnBaselineInspector(bool* emitted, JSOp op, MDefinition* left,
                                                       MDefinition* right);
+    bool binaryArithTrySharedStub(bool* emitted, JSOp op, MDefinition* left, MDefinition* right);
 
     // binary data lookup helpers.
     TypedObjectPrediction typedObjectPrediction(MDefinition* typedObj);