Bug 1019304 - Part 4: Add MUnreachable to end basic blocks that have bails in them. (r=sunfish)

js/src/jit/CodeGenerator.cpp

@@ -2711,6 +2711,13 @@ CodeGenerator::visitBail(LBail *lir)
     return bailout(lir->snapshot());
 }
 
+bool
+CodeGenerator::visitUnreachable(LUnreachable *lir)
+{
+    masm.assumeUnreachable("end-of-block assumed unreachable");
+    return true;
+}
+
 bool
 CodeGenerator::visitGetDynamicName(LGetDynamicName *lir)
 {

js/src/jit/CodeGenerator.h

@@ -131,6 +131,7 @@ class CodeGenerator : public CodeGeneratorSpecific
     void emitPopArguments(LApplyArgsGeneric *apply, Register extraStackSize);
     bool visitApplyArgsGeneric(LApplyArgsGeneric *apply);
     bool visitBail(LBail *lir);
+    bool visitUnreachable(LUnreachable *unreachable);
     bool visitGetDynamicName(LGetDynamicName *lir);
     bool visitFilterArgumentsOrEvalS(LFilterArgumentsOrEvalS *lir);
     bool visitFilterArgumentsOrEvalV(LFilterArgumentsOrEvalV *lir);

js/src/jit/LIR-Common.h

@@ -1199,6 +1199,12 @@ class LBail : public LInstructionHelper<0, 0, 0>
     LIR_HEADER(Bail)
 };
 
+class LUnreachable : public LControlInstructionHelper<0, 0, 0>
+{
+  public:
+    LIR_HEADER(Unreachable)
+};
+
 template <size_t defs, size_t ops>
 class LDOMPropertyInstructionHelper : public LCallInstructionHelper<defs, 1 + ops, 3>
 {

js/src/jit/LOpcodes.h

@@ -48,6 +48,7 @@
     _(CallNative)                   \
     _(ApplyArgsGeneric)             \
     _(Bail)                         \
+    _(Unreachable)                  \
     _(GetDynamicName)               \
     _(FilterArgumentsOrEvalS)       \
     _(FilterArgumentsOrEvalV)       \

js/src/jit/Lowering.cpp

@@ -498,6 +498,13 @@ LIRGenerator::visitBail(MBail *bail)
     return assignSnapshot(lir, bail->bailoutKind()) && add(lir, bail);
 }
 
+bool
+LIRGenerator::visitUnreachable(MUnreachable *unreachable)
+{
+    LUnreachable *lir = new(alloc()) LUnreachable();
+    return add(lir, unreachable);
+}
+
 bool
 LIRGenerator::visitAssertFloat32(MAssertFloat32 *assertion)
 {

js/src/jit/Lowering.h

@@ -99,6 +99,7 @@ class LIRGenerator : public LIRGeneratorSpecific
     bool visitApplyArgs(MApplyArgs *apply);
     bool visitArraySplice(MArraySplice *splice);
     bool visitBail(MBail *bail);
+    bool visitUnreachable(MUnreachable *unreachable);
     bool visitAssertFloat32(MAssertFloat32 *ins);
     bool visitGetDynamicName(MGetDynamicName *ins);
     bool visitFilterArgumentsOrEval(MFilterArgumentsOrEval *ins);

js/src/jit/MIR.h

@@ -2274,11 +2274,11 @@ class MApplyArgs
     }
 };
 
-class MBail : public MAryControlInstruction<0, 0>
+class MBail : public MNullaryInstruction
 {
   protected:
     MBail(BailoutKind kind)
-      : MAryControlInstruction<0, 0>()
+      : MNullaryInstruction()
     {
         bailoutKind_ = kind;
         setGuard();
@@ -2308,6 +2308,20 @@ class MBail : public MAryControlInstruction<0, 0>
     }
 };
 
+class MUnreachable : public MAryControlInstruction<0, 0>
+{
+  public:
+    INSTRUCTION_HEADER(Unreachable)
+
+    static MUnreachable *New(TempAllocator &alloc) {
+        return new(alloc) MUnreachable();
+    }
+
+    AliasSet getAliasSet() const {
+        return AliasSet::None();
+    }
+};
+
 class MAssertFloat32 : public MUnaryInstruction
 {
   protected:

js/src/jit/MOpcodes.h

@@ -43,6 +43,7 @@ namespace jit {
     _(ApplyArgs)                                                            \
     _(ArraySplice)                                                          \
     _(Bail)                                                                 \
+    _(Unreachable)                                                          \
     _(AssertFloat32)                                                        \
     _(GetDynamicName)                                                       \
     _(FilterArgumentsOrEval)                                                \

js/src/jit/ParallelSafetyAnalysis.cpp

@@ -75,7 +75,6 @@ class ParallelSafetyVisitor : public MInstructionVisitor
 
     bool replaceWithNewPar(MInstruction *newInstruction, JSObject *templateObject);
     bool replace(MInstruction *oldInstruction, MInstruction *replacementInstruction);
-    bool replaceLastIns(MInstruction *oldInstruction, MControlInstruction *replacementInstruction);
 
     bool visitSpecializedInstruction(MInstruction *ins, MIRType spec, uint32_t flags);
 
@@ -141,7 +140,8 @@ class ParallelSafetyVisitor : public MInstructionVisitor
     CUSTOM_OP(Call)
     UNSAFE_OP(ApplyArgs)
     UNSAFE_OP(ArraySplice)
-    UNSAFE_OP(Bail)
+    SAFE_OP(Bail)
+    SAFE_OP(Unreachable)
     UNSAFE_OP(AssertFloat32)
     UNSAFE_OP(GetDynamicName)
     UNSAFE_OP(FilterArgumentsOrEval)
@@ -438,10 +438,11 @@ ParallelSafetyVisitor::convertToBailout(MInstructionIterator &iter)
         block->getSuccessor(i)->removePredecessor(block);
     block->discardAllInstructionsStartingAt(iter);
 
-    // End the block in the bail.
+    // End the block in a bail.
-    MBail *bailout = MBail::New(graph_.alloc());
+    MBail *bail = MBail::New(graph_.alloc());
-    TransplantResumePoint(ins, bailout);
+    TransplantResumePoint(ins, bail);
-    block->end(bailout);
+    block->add(bail);
+    block->end(MUnreachable::New(alloc()));
     return true;
 }
 
@@ -589,17 +590,6 @@ ParallelSafetyVisitor::replace(MInstruction *oldInstruction,
     return true;
 }
 
-bool
-ParallelSafetyVisitor::replaceLastIns(MInstruction *oldInstruction,
-                                      MControlInstruction *replacementInstruction)
-{
-    TransplantResumePoint(oldInstruction, replacementInstruction);
-    MBasicBlock *block = oldInstruction->block();
-    block->discardLastIns();
-    block->end(replacementInstruction);
-    return true;
-}
-
 /////////////////////////////////////////////////////////////////////////////
 // Write Guards
 //
@@ -763,8 +753,12 @@ ParallelSafetyVisitor::visitSpecializedInstruction(MInstruction *ins, MIRType sp
 bool
 ParallelSafetyVisitor::visitThrow(MThrow *thr)
 {
-    JS_ASSERT(thr->block()->lastIns() == thr);
+    MBasicBlock *block = thr->block();
-    replaceLastIns(thr, MBail::New(alloc()));
+    JS_ASSERT(block->lastIns() == thr);
+    MBail *bail = MBail::New(alloc());
+    TransplantResumePoint(thr, bail);
+    block->discardLastIns();
+    block->end(MUnreachable::New(alloc()));
     return true;
 }