From f6ffd740692c69a8706b720b499e52fe03a40c97 Mon Sep 17 00:00:00 2001
From: Sean Stangl <sstangl@mozilla.com>
Date: Mon, 28 Jun 2010 01:14:48 -0700
Subject: [PATCH] [JAEGER] Clean up jsop_neg(). (575192, r=dvander)

---
 js/src/methodjit/FrameState.h              |  4 +--
 js/src/methodjit/nunbox/FastArithmetic.cpp | 36 +++++-----------------
 2 files changed, 8 insertions(+), 32 deletions(-)

diff --git a/js/src/methodjit/FrameState.h b/js/src/methodjit/FrameState.h
index 9ec4285ce74..f939ed1a5b0 100644
--- a/js/src/methodjit/FrameState.h
+++ b/js/src/methodjit/FrameState.h
@@ -410,7 +410,6 @@ class FrameState
      */
     void forgetEverything();
 
-
     /*
      * Throw away the entire frame state, without syncing anything.
      */
@@ -527,10 +526,9 @@ class FrameState
 
     inline void addEscaping(uint32 local);
 
-    /* FIXME: Should be private: hack during FrameState redesign. */
-    inline void forgetReg(RegisterID reg);
   private:
     inline RegisterID allocReg(FrameEntry *fe, RematInfo::RematType type, bool weak);
+    inline void forgetReg(RegisterID reg);
     RegisterID evictSomeReg(uint32 mask);
     void evictReg(RegisterID reg);
     inline FrameEntry *rawPush();
diff --git a/js/src/methodjit/nunbox/FastArithmetic.cpp b/js/src/methodjit/nunbox/FastArithmetic.cpp
index 52454c83cb9..08e80e8a30f 100644
--- a/js/src/methodjit/nunbox/FastArithmetic.cpp
+++ b/js/src/methodjit/nunbox/FastArithmetic.cpp
@@ -555,6 +555,7 @@ mjit::Compiler::jsop_binary(JSOp op, VoidStub stub)
 }
 
 static const uint64 DoubleNegMask = 0x8000000000000000LLU;
+
 void
 mjit::Compiler::jsop_neg()
 {
@@ -570,12 +571,15 @@ mjit::Compiler::jsop_neg()
 
     JS_ASSERT(!fe->isConstant());
 
-    /* Load type information into register. */
+    /* 
+     * Load type information into register.
+     * TODO: Optimize code emission if types are known.
+     */
     MaybeRegisterID feTypeReg;
-    //TODO: Optimize code emission if types are known.
     if (!frame.shouldAvoidTypeRemat(fe)) {
         /* Safe because only one type is loaded. */
         feTypeReg.setReg(frame.tempRegForType(fe));
+
         /* Don't get clobbered by copyDataIntoReg(). */
         frame.pinReg(feTypeReg.getReg());
     }
@@ -625,35 +629,9 @@ mjit::Compiler::jsop_neg()
         jmpIntRejoin.setJump(stubcc.masm.jump());
     }
 
+    frame.freeReg(reg);
     if (feTypeReg.isSet())
         frame.unpinReg(feTypeReg.getReg());
-    
-    /*
-     * :FIXME:
-     * copyDataIntoReg() acquires a register, but does not mark
-     * regstate[reg].fe, since the register does not reflect
-     * the state of the FrameEntry. But the freeRegs variable
-     * is updated to reflect that the register is allocated.
-     *
-     * assertValidRegisterState() walks over each FrameEntry in
-     * the tracker and collects the registers that are bound
-     * to a FrameEntry. Since the register acquired by
-     * copyDataIntoReg() is not bound to a FrameEntry, it is
-     * not counted in checkedFreeRegs.
-     *
-     * assertValidRegisterState() then asserts that
-     * checkedFreeRegs == freeRegs and fails. In summary,
-     * copyDataIntoReg() is only useful to mean "get a return type",
-     * which only works if pushUntypedPayload() is used on
-     * the inline path, which is not the case here.
-     *
-     * forgetReg() is thus exported for use here as a quick hack.
-     *
-     * Since this function is being integrated to serve as
-     * example code during FrameState redesign, this comment is left
-     * to point out more path merging issues.
-     */
-    frame.forgetReg(reg);
 
     stubcc.leave();
     stubcc.call(stubs::Neg);