From ff7fcbcbc7232bc04a6862226a0556debbfc96db Mon Sep 17 00:00:00 2001 From: Ryan VanderMeulen Date: Wed, 10 Sep 2014 18:35:52 -0400 Subject: [PATCH] Backed out changeset 72ec272d143d (bug 1005922) for B2G debug emulator-kk bustage. --- js/src/jit/IonBuilder.cpp | 68 +++++++-------------------- js/src/jit/Lowering.cpp | 6 --- js/src/jit/Lowering.h | 1 - js/src/jit/MIR.h | 15 ------ js/src/jit/MOpcodes.h | 3 +- js/src/jit/ParallelSafetyAnalysis.cpp | 1 - 6 files changed, 19 insertions(+), 75 deletions(-) diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp index 182fece3354..11d913639fb 100644 --- a/js/src/jit/IonBuilder.cpp +++ b/js/src/jit/IonBuilder.cpp @@ -5733,24 +5733,11 @@ bool IonBuilder::jsop_newarray(uint32_t count) { JSObject *templateObject = inspector->getTemplateObject(pc); - if (!templateObject) { - if (info().executionMode() == ArgumentsUsageAnalysis) { - MUnknownValue *unknown = MUnknownValue::New(alloc()); - current->add(unknown); - current->push(unknown); - return true; - } + if (!templateObject) return abort("No template object for NEWARRAY"); - } JS_ASSERT(templateObject->is()); if (templateObject->type()->unknownProperties()) { - if (info().executionMode() == ArgumentsUsageAnalysis) { - MUnknownValue *unknown = MUnknownValue::New(alloc()); - current->add(unknown); - current->push(unknown); - return true; - } // We will get confused in jsop_initelem_array if we can't find the // type object being initialized. return abort("New array has unknown properties"); @@ -5801,15 +5788,8 @@ bool IonBuilder::jsop_newobject() { JSObject *templateObject = inspector->getTemplateObject(pc); - if (!templateObject) { - if (info().executionMode() == ArgumentsUsageAnalysis) { - MUnknownValue *unknown = MUnknownValue::New(alloc()); - current->add(unknown); - current->push(unknown); - return true; - } + if (!templateObject) return abort("No template object for NEWOBJECT"); - } JS_ASSERT(templateObject->is()); MConstant *templateConst = MConstant::NewConstraintlessObject(alloc(), templateObject); @@ -5849,19 +5829,15 @@ IonBuilder::jsop_initelem_array() // intializer, and that arrays are marked as non-packed when writing holes // to them during initialization. bool needStub = false; - if (obj->isUnknownValue()) { - needStub = true; - } else { - types::TypeObjectKey *initializer = obj->resultTypeSet()->getObject(0); - if (value->type() == MIRType_MagicHole) { - if (!initializer->hasFlags(constraints(), types::OBJECT_FLAG_NON_PACKED)) - needStub = true; - } else if (!initializer->unknownProperties()) { - types::HeapTypeSetKey elemTypes = initializer->property(JSID_VOID); - if (!TypeSetIncludes(elemTypes.maybeTypes(), value->type(), value->resultTypeSet())) { - elemTypes.freeze(constraints()); - needStub = true; - } + types::TypeObjectKey *initializer = obj->resultTypeSet()->getObject(0); + if (value->type() == MIRType_MagicHole) { + if (!initializer->hasFlags(constraints(), types::OBJECT_FLAG_NON_PACKED)) + needStub = true; + } else if (!initializer->unknownProperties()) { + types::HeapTypeSetKey elemTypes = initializer->property(JSID_VOID); + if (!TypeSetIncludes(elemTypes.maybeTypes(), value->type(), value->resultTypeSet())) { + elemTypes.freeze(constraints()); + needStub = true; } } @@ -5922,28 +5898,20 @@ IonBuilder::jsop_initprop(PropertyName *name) MDefinition *value = current->pop(); MDefinition *obj = current->peek(-1); - JSObject *templateObject = nullptr; - Shape *shape = nullptr; + JSObject *templateObject = obj->toNewObject()->templateObject(); - bool useSlowPath = false; + Shape *shape = templateObject->lastProperty()->searchLinear(NameToId(name)); - if (obj->isUnknownValue()) { - useSlowPath = true; - } else { - templateObject = obj->toNewObject()->templateObject(); - shape = templateObject->lastProperty()->searchLinear(NameToId(name)); - - if (!shape) - useSlowPath = true; + if (!shape) { + // JSOP_NEWINIT becomes an MNewObject without preconfigured properties. + MInitProp *init = MInitProp::New(alloc(), obj, name, value); + current->add(init); + return resumeAfter(init); } if (PropertyWriteNeedsTypeBarrier(alloc(), constraints(), current, &obj, name, &value, /* canModify = */ true)) { - useSlowPath = true; - } - - if (useSlowPath) { // JSOP_NEWINIT becomes an MNewObject without preconfigured properties. MInitProp *init = MInitProp::New(alloc(), obj, name, value); current->add(init); diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp index 32419497d2a..278b4b32b20 100644 --- a/js/src/jit/Lowering.cpp +++ b/js/src/jit/Lowering.cpp @@ -3999,9 +3999,3 @@ LIRGenerator::visitArrayState(MArrayState *objState) // ArrayState nodes are always recovered on bailouts MOZ_CRASH("Unexpected ArrayState node during Lowering."); } - -bool -LIRGenerator::visitUnknownValue(MUnknownValue *ins) -{ - MOZ_CRASH("Can not lower unknown value."); -} diff --git a/js/src/jit/Lowering.h b/js/src/jit/Lowering.h index 77d0ba0040b..ff71270b9a0 100644 --- a/js/src/jit/Lowering.h +++ b/js/src/jit/Lowering.h @@ -279,7 +279,6 @@ class LIRGenerator : public LIRGeneratorSpecific bool visitBeta(MBeta *ins); bool visitObjectState(MObjectState *ins); bool visitArrayState(MArrayState *ins); - bool visitUnknownValue(MUnknownValue *ins); }; } // namespace jit diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h index 81aa03d06f2..79f16cc3890 100644 --- a/js/src/jit/MIR.h +++ b/js/src/jit/MIR.h @@ -11671,21 +11671,6 @@ class MAsmJSCall MOZ_FINAL : public MVariadicInstruction } }; -class MUnknownValue : public MNullaryInstruction -{ - protected: - MUnknownValue() { - setResultType(MIRType_Value); - } - - public: - INSTRUCTION_HEADER(UnknownValue) - - static MUnknownValue *New(TempAllocator &alloc) { - return new(alloc) MUnknownValue(); - } -}; - #undef INSTRUCTION_HEADER void MUse::init(MDefinition *producer, MNode *consumer) diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h index 361d1c78474..569518fe10c 100644 --- a/js/src/jit/MOpcodes.h +++ b/js/src/jit/MOpcodes.h @@ -242,8 +242,7 @@ namespace jit { _(ForkJoinGetSlice) \ _(GuardThreadExclusive) \ _(InterruptCheckPar) \ - _(RecompileCheck) \ - _(UnknownValue) + _(RecompileCheck) // Forward declarations of MIR types. #define FORWARD_DECLARE(op) class M##op; diff --git a/js/src/jit/ParallelSafetyAnalysis.cpp b/js/src/jit/ParallelSafetyAnalysis.cpp index 23bd281182a..907bbca2ebf 100644 --- a/js/src/jit/ParallelSafetyAnalysis.cpp +++ b/js/src/jit/ParallelSafetyAnalysis.cpp @@ -341,7 +341,6 @@ class ParallelSafetyVisitor : public MDefinitionVisitor UNSAFE_OP(AsmJSParameter) UNSAFE_OP(AsmJSCall) DROP_OP(RecompileCheck) - UNSAFE_OP(UnknownValue) // It looks like this could easily be made safe: UNSAFE_OP(ConvertElementsToDoubles)