Revert "Recover overflow of arguments from the stack. (Bug 754720, r=)"

This reverts commit b97b7034c9a9f222672601ac6245a887de5e5add.

js/src/ion/Ion.cpp

@@ -959,10 +959,6 @@ EnterIon(JSContext *cx, StackFrame *fp, void *jitcode)
     if (fp->isFunctionFrame()) {
         argc = CountArgSlots(fp->fun()) - 1;
         argv = fp->formalArgs() - 1;
-        if (fp->hasOverflowArgs()) {
-            argc = fp->numActualArgs() + 1;
-            argv = fp->actualArgs() - 1;
-        }
         calleeToken = CalleeToToken(fp->callee().toFunction());
     } else {
         calleeToken = CalleeToToken(fp->script());

js/src/ion/IonFrameIterator-inl.h

@@ -57,26 +57,15 @@ InlineFrameIterator::forEachCanonicalActualArg(Op op, unsigned start, unsigned c
     unsigned end = start + count;
     JS_ASSERT(start <= end && end <= nactual);
 
-    unsigned nformal = callee()->nargs;
-    unsigned formalEnd = end;
-    if (!more() && end > nformal)
-        formalEnd = nformal;
-    else
-        // Currently inlining does not support overflow of arguments, we have to
-        // add this feature in IonBuilder.cpp and in Bailouts.cpp before
-        // continuing. We need to add it to Bailouts.cpp because we need to know
-        // how to walk over the oveflow of arguments.
-        JS_ASSERT(end <= nformal);
-
     SnapshotIterator s(si_);
-
+    
     s.skip(); // scopeChain
     s.skip(); // this
 
     unsigned i = 0;
     for (; i < start; i++)
         s.skip();
-    for (; i < formalEnd; i++) {
+    for (; i < end; i++) {
         // We are not always able to read values from the snapshots, some values
         // such as non-gc things may still be live in registers and cause an
         // error while reading the machine state.
@@ -84,13 +73,6 @@ InlineFrameIterator::forEachCanonicalActualArg(Op op, unsigned start, unsigned c
         if (!op(i, &v))
             return false;
     }
-    if (formalEnd != end) {
-        Value *argv = frame_->argv() + 1;
-        for (; i < end; i++) {
-            if (!op(i, &argv[i]))
-                return false;
-        }
-    }
     return true;
 }
 

js/src/ion/IonFrameIterator.h

@@ -151,7 +151,6 @@ class IonFrameIterator
     unsigned numActualArgs() const;
     JSScript *script() const;
     Value *nativeVp() const;
-    Value *argv() const;
 
     // Returns the return address of the frame above this one (that is, the
     // return address that returns back to the current frame).

js/src/ion/IonFrames.cpp

@@ -234,12 +234,6 @@ IonFrameIterator::nativeVp() const
     return exitFrame()->nativeVp();
 }
 
-Value *
-IonFrameIterator::argv() const
-{
-    return jsFrame()->argv();
-}
-
 uint8 *
 IonFrameIterator::prevFp() const
 {
@@ -666,7 +660,7 @@ SnapshotIterator::SnapshotIterator()
 bool
 SnapshotIterator::hasLocation(const SnapshotReader::Location &loc)
 {
-    return loc.isStackSlot() || machine_.has(loc.reg());
+    return loc.isStackSlot() && machine_.has(loc.reg());
 }
 
 uintptr_t

js/src/jit-test/tests/ion/bug754720.js

@@ -1,64 +0,0 @@
-function f2(a) {
-  return f2.arguments;
-}
-
-// The first eager-compiled call will bailout, do not assert.
-f2();
-
-var o;
-o = f2();
-assertEq(o.length, 0);
-
-o = f2(21);
-assertEq(o.length, 1);
-assertEq(o[0], 21);
-
-o = f2(21,42);
-assertEq(o.length, 2);
-assertEq(o[0], 21);
-assertEq(o[1], 42);
-
-// 100 arguments.
-o = f2(0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9);
-for (var i in o)
-    assertEq(o[i], i % 10);
-
-// 200 arguments.
-o = f2(0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9);
-for (var i in o)
-    assertEq(o[i], i % 10);
-
-// 300 arguments.
-o = f2(0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
-       0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9);
-for (var i in o)
-    assertEq(o[i], i % 10);

js/src/vm/Stack.cpp

@@ -1483,6 +1483,11 @@ StackIter::numActualArgs() const
         JS_ASSERT(isFunctionFrame());
         return fp()->numActualArgs();
       case ION:
+        // :TODO: We need to handle actual arguments in IonMonkey.  Currently we
+        // cannot easily read all arguments used for the call and we do not want
+        // to hack around it because a part of Bug 735406 is to instrucment Ion
+        // frames to provide actual arguments.
+        JS_ASSERT(ionInlineFrames_.numActualArgs() <= ionInlineFrames_.callee()->nargs);
         return ionInlineFrames_.numActualArgs();
       case NATIVE:
       case IMPLICIT_NATIVE: