mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
Backed out changeset 72ec272d143d (bug 1005922) for B2G debug emulator-kk bustage.
This commit is contained in:
parent
c1678608c7
commit
ff7fcbcbc7
@ -5733,24 +5733,11 @@ bool
|
||||
IonBuilder::jsop_newarray(uint32_t count)
|
||||
{
|
||||
JSObject *templateObject = inspector->getTemplateObject(pc);
|
||||
if (!templateObject) {
|
||||
if (info().executionMode() == ArgumentsUsageAnalysis) {
|
||||
MUnknownValue *unknown = MUnknownValue::New(alloc());
|
||||
current->add(unknown);
|
||||
current->push(unknown);
|
||||
return true;
|
||||
}
|
||||
if (!templateObject)
|
||||
return abort("No template object for NEWARRAY");
|
||||
}
|
||||
|
||||
JS_ASSERT(templateObject->is<ArrayObject>());
|
||||
if (templateObject->type()->unknownProperties()) {
|
||||
if (info().executionMode() == ArgumentsUsageAnalysis) {
|
||||
MUnknownValue *unknown = MUnknownValue::New(alloc());
|
||||
current->add(unknown);
|
||||
current->push(unknown);
|
||||
return true;
|
||||
}
|
||||
// We will get confused in jsop_initelem_array if we can't find the
|
||||
// type object being initialized.
|
||||
return abort("New array has unknown properties");
|
||||
@ -5801,15 +5788,8 @@ bool
|
||||
IonBuilder::jsop_newobject()
|
||||
{
|
||||
JSObject *templateObject = inspector->getTemplateObject(pc);
|
||||
if (!templateObject) {
|
||||
if (info().executionMode() == ArgumentsUsageAnalysis) {
|
||||
MUnknownValue *unknown = MUnknownValue::New(alloc());
|
||||
current->add(unknown);
|
||||
current->push(unknown);
|
||||
return true;
|
||||
}
|
||||
if (!templateObject)
|
||||
return abort("No template object for NEWOBJECT");
|
||||
}
|
||||
|
||||
JS_ASSERT(templateObject->is<JSObject>());
|
||||
MConstant *templateConst = MConstant::NewConstraintlessObject(alloc(), templateObject);
|
||||
@ -5849,19 +5829,15 @@ IonBuilder::jsop_initelem_array()
|
||||
// intializer, and that arrays are marked as non-packed when writing holes
|
||||
// to them during initialization.
|
||||
bool needStub = false;
|
||||
if (obj->isUnknownValue()) {
|
||||
needStub = true;
|
||||
} else {
|
||||
types::TypeObjectKey *initializer = obj->resultTypeSet()->getObject(0);
|
||||
if (value->type() == MIRType_MagicHole) {
|
||||
if (!initializer->hasFlags(constraints(), types::OBJECT_FLAG_NON_PACKED))
|
||||
needStub = true;
|
||||
} else if (!initializer->unknownProperties()) {
|
||||
types::HeapTypeSetKey elemTypes = initializer->property(JSID_VOID);
|
||||
if (!TypeSetIncludes(elemTypes.maybeTypes(), value->type(), value->resultTypeSet())) {
|
||||
elemTypes.freeze(constraints());
|
||||
needStub = true;
|
||||
}
|
||||
types::TypeObjectKey *initializer = obj->resultTypeSet()->getObject(0);
|
||||
if (value->type() == MIRType_MagicHole) {
|
||||
if (!initializer->hasFlags(constraints(), types::OBJECT_FLAG_NON_PACKED))
|
||||
needStub = true;
|
||||
} else if (!initializer->unknownProperties()) {
|
||||
types::HeapTypeSetKey elemTypes = initializer->property(JSID_VOID);
|
||||
if (!TypeSetIncludes(elemTypes.maybeTypes(), value->type(), value->resultTypeSet())) {
|
||||
elemTypes.freeze(constraints());
|
||||
needStub = true;
|
||||
}
|
||||
}
|
||||
|
||||
@ -5922,28 +5898,20 @@ IonBuilder::jsop_initprop(PropertyName *name)
|
||||
MDefinition *value = current->pop();
|
||||
MDefinition *obj = current->peek(-1);
|
||||
|
||||
JSObject *templateObject = nullptr;
|
||||
Shape *shape = nullptr;
|
||||
JSObject *templateObject = obj->toNewObject()->templateObject();
|
||||
|
||||
bool useSlowPath = false;
|
||||
Shape *shape = templateObject->lastProperty()->searchLinear(NameToId(name));
|
||||
|
||||
if (obj->isUnknownValue()) {
|
||||
useSlowPath = true;
|
||||
} else {
|
||||
templateObject = obj->toNewObject()->templateObject();
|
||||
shape = templateObject->lastProperty()->searchLinear(NameToId(name));
|
||||
|
||||
if (!shape)
|
||||
useSlowPath = true;
|
||||
if (!shape) {
|
||||
// JSOP_NEWINIT becomes an MNewObject without preconfigured properties.
|
||||
MInitProp *init = MInitProp::New(alloc(), obj, name, value);
|
||||
current->add(init);
|
||||
return resumeAfter(init);
|
||||
}
|
||||
|
||||
if (PropertyWriteNeedsTypeBarrier(alloc(), constraints(), current,
|
||||
&obj, name, &value, /* canModify = */ true))
|
||||
{
|
||||
useSlowPath = true;
|
||||
}
|
||||
|
||||
if (useSlowPath) {
|
||||
// JSOP_NEWINIT becomes an MNewObject without preconfigured properties.
|
||||
MInitProp *init = MInitProp::New(alloc(), obj, name, value);
|
||||
current->add(init);
|
||||
|
@ -3999,9 +3999,3 @@ LIRGenerator::visitArrayState(MArrayState *objState)
|
||||
// ArrayState nodes are always recovered on bailouts
|
||||
MOZ_CRASH("Unexpected ArrayState node during Lowering.");
|
||||
}
|
||||
|
||||
bool
|
||||
LIRGenerator::visitUnknownValue(MUnknownValue *ins)
|
||||
{
|
||||
MOZ_CRASH("Can not lower unknown value.");
|
||||
}
|
||||
|
@ -279,7 +279,6 @@ class LIRGenerator : public LIRGeneratorSpecific
|
||||
bool visitBeta(MBeta *ins);
|
||||
bool visitObjectState(MObjectState *ins);
|
||||
bool visitArrayState(MArrayState *ins);
|
||||
bool visitUnknownValue(MUnknownValue *ins);
|
||||
};
|
||||
|
||||
} // namespace jit
|
||||
|
@ -11671,21 +11671,6 @@ class MAsmJSCall MOZ_FINAL : public MVariadicInstruction
|
||||
}
|
||||
};
|
||||
|
||||
class MUnknownValue : public MNullaryInstruction
|
||||
{
|
||||
protected:
|
||||
MUnknownValue() {
|
||||
setResultType(MIRType_Value);
|
||||
}
|
||||
|
||||
public:
|
||||
INSTRUCTION_HEADER(UnknownValue)
|
||||
|
||||
static MUnknownValue *New(TempAllocator &alloc) {
|
||||
return new(alloc) MUnknownValue();
|
||||
}
|
||||
};
|
||||
|
||||
#undef INSTRUCTION_HEADER
|
||||
|
||||
void MUse::init(MDefinition *producer, MNode *consumer)
|
||||
|
@ -242,8 +242,7 @@ namespace jit {
|
||||
_(ForkJoinGetSlice) \
|
||||
_(GuardThreadExclusive) \
|
||||
_(InterruptCheckPar) \
|
||||
_(RecompileCheck) \
|
||||
_(UnknownValue)
|
||||
_(RecompileCheck)
|
||||
|
||||
// Forward declarations of MIR types.
|
||||
#define FORWARD_DECLARE(op) class M##op;
|
||||
|
@ -341,7 +341,6 @@ class ParallelSafetyVisitor : public MDefinitionVisitor
|
||||
UNSAFE_OP(AsmJSParameter)
|
||||
UNSAFE_OP(AsmJSCall)
|
||||
DROP_OP(RecompileCheck)
|
||||
UNSAFE_OP(UnknownValue)
|
||||
|
||||
// It looks like this could easily be made safe:
|
||||
UNSAFE_OP(ConvertElementsToDoubles)
|
||||
|
Loading…
Reference in New Issue
Block a user