Backed out 3 changesets (bug 1658279) for perma failures on browser_topsites_section.js. CLOSED TREE
authorRazvan Maries <rmaries@mozilla.com>
Thu, 13 Aug 2020 16:16:03 +0300
changeset 544528 06e4f8547d78187f934074b2b4ff4d4d4d12efd5
parent 544527 9ef828c9bd891822d22c53a6af567023f0128568
child 544529 6dfbbf5236a447dc457e12cf7dd9933850dc5eb8
push id124091
push userrmaries@mozilla.com
push dateThu, 13 Aug 2020 13:17:36 +0000
treeherderautoland@06e4f8547d78 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1658279
milestone81.0a1
backs out728d9864385864dece4c4f6beaa3375ccd357606
761efef13026f4d6e1d873c515bea9efad5e33e8
25869d8b61484ca5abbac2d2009932761e177343
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backed out 3 changesets (bug 1658279) for perma failures on browser_topsites_section.js. CLOSED TREE Backed out changeset 728d98643858 (bug 1658279) Backed out changeset 761efef13026 (bug 1658279) Backed out changeset 25869d8b6148 (bug 1658279)
js/src/builtin/Array.cpp
js/src/jit/BaselineBailouts.cpp
js/src/jit/BaselineCacheIRCompiler.cpp
js/src/jit/CacheIR.cpp
js/src/jit/CacheIR.h
js/src/jit/CacheIRCompiler.cpp
js/src/jit/CacheIROps.yaml
js/src/jit/CodeGenerator.cpp
js/src/jit/IonCacheIRCompiler.cpp
js/src/jit/IonTypes.h
js/src/jit/Lowering.cpp
js/src/jit/MacroAssembler.cpp
js/src/jit/MacroAssembler.h
js/src/jit/WarpCacheIRTranspiler.cpp
--- a/js/src/builtin/Array.cpp
+++ b/js/src/builtin/Array.cpp
@@ -3608,18 +3608,16 @@ static bool ArraySliceDenseKernel(JSCont
   MOZ_ASSERT(count >= result->length());
   result->setLength(cx, count);
 
   return true;
 }
 
 JSObject* js::ArraySliceDense(JSContext* cx, HandleObject obj, int32_t begin,
                               int32_t end, HandleObject result) {
-  MOZ_ASSERT_IF(jit::JitOptions.warpBuilder, IsPackedArray(obj));
-
   if (result && IsArraySpecies(cx, obj)) {
     if (!ArraySliceDenseKernel(cx, &obj->as<ArrayObject>(), begin, end,
                                &result->as<ArrayObject>())) {
       return nullptr;
     }
     return result;
   }
 
--- a/js/src/jit/BaselineBailouts.cpp
+++ b/js/src/jit/BaselineBailouts.cpp
@@ -2028,17 +2028,16 @@ bool jit::FinishBailoutToBaseline(Baseli
     case BailoutKind::SpecificSymbolGuard:
     case BailoutKind::NonInt32ArrayLength:
     case BailoutKind::ProtoGuard:
     case BailoutKind::ProxyGuard:
     case BailoutKind::NotProxyGuard:
     case BailoutKind::NotDOMProxyGuard:
     case BailoutKind::NotArrayBufferMaybeSharedGuard:
     case BailoutKind::ArrayPopShift:
-    case BailoutKind::ArraySlice:
     case BailoutKind::TagNotEqualGuard:
       // Do nothing.
       break;
 
     case BailoutKind::FirstExecution:
       // Do not return directly, as this was not frequent in the first place,
       // thus rely on the check for frequent bailouts to recompile the current
       // script.
--- a/js/src/jit/BaselineCacheIRCompiler.cpp
+++ b/js/src/jit/BaselineCacheIRCompiler.cpp
@@ -1459,60 +1459,16 @@ bool BaselineCacheIRCompiler::emitArrayP
 
   // Return value is new length.
   masm.add32(Imm32(1), scratchLength);
   masm.tagValue(JSVAL_TYPE_INT32, scratchLength, val);
 
   return true;
 }
 
-bool BaselineCacheIRCompiler::emitPackedArraySliceResult(
-    uint32_t templateObjectOffset, ObjOperandId arrayId, Int32OperandId beginId,
-    Int32OperandId endId) {
-  JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
-
-  AutoOutputRegister output(*this);
-  AutoScratchRegisterMaybeOutput scratch1(allocator, masm, output);
-  AutoScratchRegisterMaybeOutputType scratch2(allocator, masm, output);
-
-  Register array = allocator.useRegister(masm, arrayId);
-  Register begin = allocator.useRegister(masm, beginId);
-  Register end = allocator.useRegister(masm, endId);
-
-  FailurePath* failure = nullptr;
-  if (!addFailurePath(&failure)) {
-    return false;
-  }
-
-  allocator.discardStack(masm);
-
-  masm.branchArrayIsNotPacked(array, scratch1, scratch2, failure->label());
-
-  AutoStubFrame stubFrame(*this);
-  stubFrame.enter(masm, scratch2);
-
-  // Don't attempt to pre-allocate the object, instead always use the slow
-  // path.
-  ImmPtr result(nullptr);
-
-  masm.Push(result);
-  masm.Push(end);
-  masm.Push(begin);
-  masm.Push(array);
-
-  using Fn =
-      JSObject* (*)(JSContext*, HandleObject, int32_t, int32_t, HandleObject);
-  callVM<Fn, ArraySliceDense>(masm);
-
-  stubFrame.leave(masm);
-
-  masm.tagValue(JSVAL_TYPE_OBJECT, ReturnReg, output.valueReg());
-  return true;
-}
-
 bool BaselineCacheIRCompiler::emitIsArrayResult(ValOperandId inputId) {
   JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
 
   AutoOutputRegister output(*this);
   AutoScratchRegister scratch1(allocator, masm);
   AutoScratchRegisterMaybeOutput scratch2(allocator, masm, output);
 
   ValueOperand val = allocator.useValueRegister(masm, inputId);
--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@@ -5019,26 +5019,26 @@ void CallIRGenerator::emitNativeCalleeGu
 
 AttachDecision CallIRGenerator::tryAttachArrayPush(HandleFunction callee) {
   // Only optimize on obj.push(val);
   if (argc_ != 1 || !thisval_.isObject()) {
     return AttachDecision::NoAction;
   }
 
   // Where |obj| is a native array.
-  JSObject* thisobj = &thisval_.toObject();
+  RootedObject thisobj(cx_, &thisval_.toObject());
   if (!thisobj->is<ArrayObject>()) {
     return AttachDecision::NoAction;
   }
 
   if (thisobj->hasLazyGroup()) {
     return AttachDecision::NoAction;
   }
 
-  auto* thisarray = &thisobj->as<ArrayObject>();
+  RootedArrayObject thisarray(cx_, &thisobj->as<ArrayObject>());
 
   // Check for other indexed properties or class hooks.
   if (!CanAttachAddElement(thisarray, /* isInit = */ false)) {
     return AttachDecision::NoAction;
   }
 
   // Can't add new elements to arrays with non-writable length.
   if (!thisarray->lengthIsWritable()) {
@@ -5161,22 +5161,22 @@ AttachDecision CallIRGenerator::tryAttac
   }
 
   // Only optimize on obj.join(...);
   if (!thisval_.isObject()) {
     return AttachDecision::NoAction;
   }
 
   // Where |obj| is a native array.
-  JSObject* thisobj = &thisval_.toObject();
+  RootedObject thisobj(cx_, &thisval_.toObject());
   if (!thisobj->is<ArrayObject>()) {
     return AttachDecision::NoAction;
   }
 
-  auto* thisarray = &thisobj->as<ArrayObject>();
+  RootedArrayObject thisarray(cx_, &thisobj->as<ArrayObject>());
 
   // And the array is of length 0 or 1.
   if (thisarray->length() > 1) {
     return AttachDecision::NoAction;
   }
 
   // And the array is packed.
   if (thisarray->getDenseInitializedLength() != thisarray->length()) {
@@ -5223,94 +5223,16 @@ AttachDecision CallIRGenerator::tryAttac
 
   // Set the stub kind to Regular
   cacheIRStubKind_ = BaselineCacheIRStubKind::Regular;
 
   trackAttached("ArrayJoin");
   return AttachDecision::Attach;
 }
 
-AttachDecision CallIRGenerator::tryAttachArraySlice(HandleFunction callee) {
-  // Only handle argc <= 2.
-  if (argc_ > 2) {
-    return AttachDecision::NoAction;
-  }
-
-  // Only optimize if |this| is a packed array.
-  if (!thisval_.isObject() || !IsPackedArray(&thisval_.toObject())) {
-    return AttachDecision::NoAction;
-  }
-
-  // Arguments for the sliced region must be integers.
-  if (argc_ > 0 && !args_[0].isInt32()) {
-    return AttachDecision::NoAction;
-  }
-  if (argc_ > 1 && !args_[1].isInt32()) {
-    return AttachDecision::NoAction;
-  }
-
-  RootedArrayObject arr(cx_, &thisval_.toObject().as<ArrayObject>());
-
-  // The group of the result will be dynamically fixed up to match the input
-  // object, allowing us to handle 'this' objects that might have more than one
-  // group. Make sure that no singletons can be sliced here.
-  if (arr->isSingleton()) {
-    return AttachDecision::NoAction;
-  }
-
-  JSObject* templateObj =
-      NewFullyAllocatedArrayTryReuseGroup(cx_, arr, 0, TenuredObject);
-  if (!templateObj) {
-    cx_->recoverFromOutOfMemory();
-    return AttachDecision::NoAction;
-  }
-
-  // Initialize the input operand.
-  Int32OperandId argcId(writer.setInputOperandId(0));
-
-  // Guard callee is the 'slice' native function.
-  emitNativeCalleeGuard(callee);
-
-  ValOperandId thisValId =
-      writer.loadArgumentFixedSlot(ArgumentKind::This, argc_);
-  ObjOperandId objId = writer.guardToObject(thisValId);
-  writer.guardClass(objId, GuardClassKind::Array);
-
-  Int32OperandId int32BeginId;
-  if (argc_ > 0) {
-    ValOperandId beginId =
-        writer.loadArgumentFixedSlot(ArgumentKind::Arg0, argc_);
-    int32BeginId = writer.guardToInt32(beginId);
-  } else {
-    int32BeginId = writer.loadInt32Constant(0);
-  }
-
-  Int32OperandId int32EndId;
-  if (argc_ > 1) {
-    ValOperandId endId =
-        writer.loadArgumentFixedSlot(ArgumentKind::Arg1, argc_);
-    int32EndId = writer.guardToInt32(endId);
-  } else {
-    int32EndId = writer.loadInt32ArrayLength(objId);
-  }
-
-  writer.packedArraySliceResult(templateObj, objId, int32BeginId, int32EndId);
-
-  if (!JitOptions.warpBuilder) {
-    // Store the template object for BaselineInspector.
-    writer.metaNativeTemplateObject(callee, templateObj);
-  }
-
-  writer.typeMonitorResult();
-  cacheIRStubKind_ = BaselineCacheIRStubKind::Monitored;
-
-  trackAttached("ArraySlice");
-  return AttachDecision::Attach;
-}
-
 AttachDecision CallIRGenerator::tryAttachArrayIsArray(HandleFunction callee) {
   // Need a single argument.
   if (argc_ != 1) {
     return AttachDecision::NoAction;
   }
 
   // Initialize the input operand.
   Int32OperandId argcId(writer.setInputOperandId(0));
@@ -8186,17 +8108,17 @@ AttachDecision CallIRGenerator::tryAttac
 
   if (argc_ != 2) {
     return AttachDecision::NoAction;
   }
 
   if (!thisval_.isObject() || !thisval_.toObject().is<JSFunction>()) {
     return AttachDecision::NoAction;
   }
-  auto* target = &thisval_.toObject().as<JSFunction>();
+  RootedFunction target(cx_, &thisval_.toObject().as<JSFunction>());
 
   bool isScripted = target->hasJitEntry();
   MOZ_ASSERT_IF(!isScripted, target->isNativeWithoutJitEntry());
 
   if (target->isClassConstructor()) {
     return AttachDecision::NoAction;
   }
 
@@ -8300,18 +8222,16 @@ AttachDecision CallIRGenerator::tryAttac
       return tryAttachArrayConstructor(callee);
     case InlinableNative::ArrayPush:
       return tryAttachArrayPush(callee);
     case InlinableNative::ArrayPop:
     case InlinableNative::ArrayShift:
       return tryAttachArrayPopShift(callee, native);
     case InlinableNative::ArrayJoin:
       return tryAttachArrayJoin(callee);
-    case InlinableNative::ArraySlice:
-      return tryAttachArraySlice(callee);
     case InlinableNative::ArrayIsArray:
       return tryAttachArrayIsArray(callee);
 
     // DataView natives.
     case InlinableNative::DataViewGetInt8:
       return tryAttachDataViewGet(callee, Scalar::Int8);
     case InlinableNative::DataViewGetUint8:
       return tryAttachDataViewGet(callee, Scalar::Uint8);
@@ -8804,18 +8724,16 @@ bool CallIRGenerator::getTemplateObjectF
     return true;
   }
 
   if (!calleeFunc->hasJitInfo() ||
       calleeFunc->jitInfo()->type() != JSJitInfo::InlinableNative) {
     return true;
   }
 
-  bool isConstructing = IsConstructOp(op_);
-
   // Check for natives to which template objects can be attached. This is
   // done to provide templates to Ion for inlining these natives later on.
   switch (calleeFunc->jitInfo()->inlinableNative) {
     case InlinableNative::Array: {
       // Note: the template array won't be used if its length is inaccurately
       // computed here.  (We allocate here because compilation may occur on a
       // separate thread where allocation is impossible.)
 
@@ -8841,36 +8759,21 @@ bool CallIRGenerator::getTemplateObjectF
         return true;
       }
 
       RootedObject obj(cx_, &thisval_.toObject());
       if (obj->isSingleton()) {
         return true;
       }
 
-      if (IsPackedArray(obj)) {
-        // This case is handled by tryAttachArraySlice.
-        return true;
-      }
-
-      // TODO(Warp): Support non-packed arrays in tryAttachArraySlice if they're
-      // common in user code.
-      if (JitOptions.warpBuilder) {
-        return true;
-      }
-
       res.set(NewFullyAllocatedArrayTryReuseGroup(cx_, obj, 0, TenuredObject));
       return !!res;
     }
 
     case InlinableNative::String: {
-      if (!isConstructing) {
-        return true;
-      }
-
       RootedString emptyString(cx_, cx_->runtime()->emptyString);
       res.set(StringObject::create(cx_, emptyString, /* proto = */ nullptr,
                                    TenuredObject));
       return !!res;
     }
 
     default:
       return true;
@@ -9014,17 +8917,17 @@ AttachDecision CallIRGenerator::tryAttac
     return AttachDecision::NoAction;
   }
 
   RootedObject calleeObj(cx_, &callee_.toObject());
   if (!calleeObj->is<JSFunction>()) {
     return tryAttachCallHook(calleeObj);
   }
 
-  HandleFunction calleeFunc = calleeObj.as<JSFunction>();
+  RootedFunction calleeFunc(cx_, &calleeObj->as<JSFunction>());
 
   // Check for scripted optimizations.
   if (calleeFunc->hasJitEntry()) {
     return tryAttachCallScripted(calleeFunc);
   }
 
   // Check for native-function optimizations.
   MOZ_ASSERT(calleeFunc->isNativeWithoutJitEntry());
@@ -10726,18 +10629,18 @@ AttachDecision NewObjectIRGenerator::try
 
   trackAttached("NewObjectWithTemplate");
   return AttachDecision::Attach;
 }
 
 #ifdef JS_SIMULATOR
 bool js::jit::CallAnyNative(JSContext* cx, unsigned argc, Value* vp) {
   CallArgs args = CallArgsFromVp(argc, vp);
-  JSObject* calleeObj = &args.callee();
+  RootedObject calleeObj(cx, &args.callee());
 
   MOZ_ASSERT(calleeObj->is<JSFunction>());
-  auto* calleeFunc = &calleeObj->as<JSFunction>();
+  RootedFunction calleeFunc(cx, &calleeObj->as<JSFunction>());
   MOZ_ASSERT(calleeFunc->isNativeWithoutJitEntry());
 
   JSNative native = calleeFunc->native();
   return native(cx, args.length(), args.base());
 }
 #endif
--- a/js/src/jit/CacheIR.h
+++ b/js/src/jit/CacheIR.h
@@ -1631,17 +1631,16 @@ class MOZ_RAII CallIRGenerator : public 
 
   AtomicsReadWriteModifyOperands emitAtomicsReadWriteModifyOperands(
       HandleFunction callee);
 
   AttachDecision tryAttachArrayPush(HandleFunction callee);
   AttachDecision tryAttachArrayPopShift(HandleFunction callee,
                                         InlinableNative native);
   AttachDecision tryAttachArrayJoin(HandleFunction callee);
-  AttachDecision tryAttachArraySlice(HandleFunction callee);
   AttachDecision tryAttachArrayIsArray(HandleFunction callee);
   AttachDecision tryAttachDataViewGet(HandleFunction callee, Scalar::Type type);
   AttachDecision tryAttachDataViewSet(HandleFunction callee, Scalar::Type type);
   AttachDecision tryAttachUnsafeGetReservedSlot(HandleFunction callee,
                                                 InlinableNative native);
   AttachDecision tryAttachUnsafeSetReservedSlot(HandleFunction callee);
   AttachDecision tryAttachIsSuspendedGenerator(HandleFunction callee);
   AttachDecision tryAttachToObject(HandleFunction callee,
--- a/js/src/jit/CacheIRCompiler.cpp
+++ b/js/src/jit/CacheIRCompiler.cpp
@@ -2474,35 +2474,16 @@ bool CacheIRCompiler::emitLoadInt32Array
   masm.load32(Address(scratch, ObjectElements::offsetOfLength()), scratch);
 
   // Guard length fits in an int32.
   masm.branchTest32(Assembler::Signed, scratch, scratch, failure->label());
   EmitStoreResult(masm, scratch, JSVAL_TYPE_INT32, output);
   return true;
 }
 
-bool CacheIRCompiler::emitLoadInt32ArrayLength(ObjOperandId objId,
-                                               Int32OperandId resultId) {
-  JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
-  Register obj = allocator.useRegister(masm, objId);
-  Register res = allocator.defineRegister(masm, resultId);
-
-  FailurePath* failure;
-  if (!addFailurePath(&failure)) {
-    return false;
-  }
-
-  masm.loadPtr(Address(obj, NativeObject::offsetOfElements()), res);
-  masm.load32(Address(res, ObjectElements::offsetOfLength()), res);
-
-  // Guard length fits in an int32.
-  masm.branchTest32(Assembler::Signed, res, res, failure->label());
-  return true;
-}
-
 bool CacheIRCompiler::emitDoubleAddResult(NumberOperandId lhsId,
                                           NumberOperandId rhsId) {
   JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
   AutoOutputRegister output(*this);
 
   // Float register must be preserved. The BinaryArith ICs use
   // the fact that baseline has them available, as well as fixed temps on
   // LBinaryCache.
@@ -8043,20 +8024,16 @@ template <>
 struct ReturnTypeToJSValueType<JSString*> {
   static constexpr JSValueType result = JSVAL_TYPE_STRING;
 };
 template <>
 struct ReturnTypeToJSValueType<BigInt*> {
   static constexpr JSValueType result = JSVAL_TYPE_BIGINT;
 };
 template <>
-struct ReturnTypeToJSValueType<JSObject*> {
-  static constexpr JSValueType result = JSVAL_TYPE_OBJECT;
-};
-template <>
 struct ReturnTypeToJSValueType<ArrayIteratorObject*> {
   static constexpr JSValueType result = JSVAL_TYPE_OBJECT;
 };
 template <>
 struct ReturnTypeToJSValueType<StringIteratorObject*> {
   static constexpr JSValueType result = JSVAL_TYPE_OBJECT;
 };
 template <>
--- a/js/src/jit/CacheIROps.yaml
+++ b/js/src/jit/CacheIROps.yaml
@@ -917,26 +917,16 @@
 
 - name: PackedArrayShiftResult
   shared: true
   transpile: true
   cost_estimate: 4
   args:
     array: ObjId
 
-- name: PackedArraySliceResult
-  shared: false
-  transpile: true
-  cost_estimate: 5
-  args:
-    templateObject: ObjectField
-    array: ObjId
-    begin: Int32Id
-    end: Int32Id
-
 - name: IsArrayResult
   shared: false
   transpile: true
   cost_estimate: 5
   args:
     input: ValId
 
 - name: StoreFixedSlotUndefinedResult
@@ -1667,24 +1657,16 @@
 
 - name: LoadInt32ArrayLengthResult
   shared: true
   transpile: true
   cost_estimate: 1
   args:
     obj: ObjId
 
-- name: LoadInt32ArrayLength
-  shared: true
-  transpile: true
-  cost_estimate: 1
-  args:
-    obj: ObjId
-    result: Int32Id
-
 - name: LoadArgumentsObjectArgResult
   shared: true
   transpile: false
   cost_estimate: 2
   args:
     obj: ObjId
     index: Int32Id
 
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -10529,23 +10529,16 @@ void CodeGenerator::visitArraySlice(LArr
   Register object = ToRegister(lir->object());
   Register begin = ToRegister(lir->begin());
   Register end = ToRegister(lir->end());
   Register temp1 = ToRegister(lir->temp1());
   Register temp2 = ToRegister(lir->temp2());
 
   Label call, fail;
 
-  if (JitOptions.warpBuilder) {
-    Label bail;
-    masm.branchArrayIsNotPacked(object, temp1, temp2, &bail);
-
-    bailoutFrom(&bail, lir->snapshot());
-  }
-
   // Try to allocate an object.
   TemplateObject templateObject(lir->mir()->templateObj());
   masm.createGCObject(temp1, temp2, templateObject, lir->mir()->initialHeap(),
                       &fail);
 
   // Fixup the group of the result in case it doesn't match the template object.
   masm.copyObjGroupNoPreBarrier(object, temp1, temp2);
 
--- a/js/src/jit/IonCacheIRCompiler.cpp
+++ b/js/src/jit/IonCacheIRCompiler.cpp
@@ -1861,16 +1861,21 @@ bool IonCacheIRCompiler::emitStoreDenseE
   masm.bind(&doStore);
   EmitStoreDenseElement(masm, val, scratch1, element);
   if (needsPostBarrier()) {
     emitPostBarrierElement(obj, val, scratch1, index);
   }
   return true;
 }
 
+bool IonCacheIRCompiler::emitArrayPush(ObjOperandId objId, ValOperandId rhsId) {
+  MOZ_ASSERT_UNREACHABLE("emitArrayPush not supported for IonCaches.");
+  return false;
+}
+
 bool IonCacheIRCompiler::emitCallNativeSetter(ObjOperandId objId,
                                               uint32_t setterOffset,
                                               ValOperandId rhsId) {
   JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
   AutoSaveLiveRegisters save(*this);
 
   Register obj = allocator.useRegister(masm, objId);
   JSFunction* target = &objectStubField(setterOffset)->as<JSFunction>();
@@ -2429,26 +2434,16 @@ bool IonCacheIRCompiler::emitLoadArgumen
   MOZ_CRASH("Call ICs not used in ion");
 }
 
 bool IonCacheIRCompiler::emitGuardFunApply(Int32OperandId argcId,
                                            CallFlags flags) {
   MOZ_CRASH("Call ICs not used in ion");
 }
 
-bool IonCacheIRCompiler::emitArrayPush(ObjOperandId objId, ValOperandId rhsId) {
-  MOZ_CRASH("Call ICs not used in ion");
-}
-
-bool IonCacheIRCompiler::emitPackedArraySliceResult(
-    uint32_t templateObjectOffset, ObjOperandId arrayId, Int32OperandId beginId,
-    Int32OperandId endId) {
-  MOZ_CRASH("Call ICs not used in ion");
-}
-
 bool IonCacheIRCompiler::emitIsArrayResult(ValOperandId inputId) {
   MOZ_CRASH("Call ICs not used in ion");
 }
 
 bool IonCacheIRCompiler::emitIsTypedArrayResult(ObjOperandId objId,
                                                 bool isPossiblyWrapped) {
   MOZ_CRASH("Call ICs not used in ion");
 }
--- a/js/src/jit/IonTypes.h
+++ b/js/src/jit/IonTypes.h
@@ -180,19 +180,16 @@ enum class BailoutKind : uint8_t {
   NotDOMProxyGuard,
 
   // Bailout triggered by MGuardIsNotArrayBufferMaybeShared.
   NotArrayBufferMaybeSharedGuard,
 
   // Bailout triggered by MArrayPopShift.
   ArrayPopShift,
 
-  // Bailout triggered by MArraySlice.
-  ArraySlice,
-
   // Bailout triggered by MGuardValue.
   ValueGuard,
 
   // Bailout triggered by MGuardNotOptimizedArguments.
   NotOptimizedArgumentsGuard,
 
   // Bailout triggered by MGuardNullOrUndefined.
   NullOrUndefinedGuard,
@@ -285,18 +282,16 @@ inline const char* BailoutKindString(Bai
     case BailoutKind::NotProxyGuard:
       return "BailoutKind::NotProxyGuard";
     case BailoutKind::NotDOMProxyGuard:
       return "BailoutKind::NotDOMProxyGuard";
     case BailoutKind::NotArrayBufferMaybeSharedGuard:
       return "BailoutKind::NotArrayBufferMaybeSharedGuard";
     case BailoutKind::ArrayPopShift:
       return "BailoutKind::ArrayPopShift";
-    case BailoutKind::ArraySlice:
-      return "BailoutKind::ArraySlice";
     case BailoutKind::ValueGuard:
       return "BailoutKind::ValueGuard";
     case BailoutKind::NotOptimizedArgumentsGuard:
       return "BailoutKind::NotOptimizedArgumentsGuard";
     case BailoutKind::NullOrUndefinedGuard:
       return "BailoutKind::NullOrUndefinedGuard";
     case BailoutKind::TagNotEqualGuard:
       return "BailoutKind::TagNotEqualGuard";
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -3531,19 +3531,16 @@ void LIRGenerator::visitArraySlice(MArra
   MOZ_ASSERT(ins->begin()->type() == MIRType::Int32);
   MOZ_ASSERT(ins->end()->type() == MIRType::Int32);
 
   LArraySlice* lir = new (alloc())
       LArraySlice(useFixedAtStart(ins->object(), CallTempReg0),
                   useFixedAtStart(ins->begin(), CallTempReg1),
                   useFixedAtStart(ins->end(), CallTempReg2),
                   tempFixed(CallTempReg3), tempFixed(CallTempReg4));
-  if (JitOptions.warpBuilder) {
-    assignSnapshot(lir, BailoutKind::ArraySlice);
-  }
   defineReturn(lir, ins);
   assignSafepoint(lir, ins);
 }
 
 void LIRGenerator::visitArrayJoin(MArrayJoin* ins) {
   MOZ_ASSERT(ins->type() == MIRType::String);
   MOZ_ASSERT(ins->array()->type() == MIRType::Object);
   MOZ_ASSERT(ins->sep()->type() == MIRType::String);
--- a/js/src/jit/MacroAssembler.cpp
+++ b/js/src/jit/MacroAssembler.cpp
@@ -3913,42 +3913,36 @@ void MacroAssembler::debugAssertObjHasFi
   branchTest32(Assembler::NonZero,
                Address(scratch, Shape::offsetOfImmutableFlags()),
                Imm32(Shape::fixedSlotsMask()), &hasFixedSlots);
   assumeUnreachable("Expected a fixed slot");
   bind(&hasFixedSlots);
 #endif
 }
 
-void MacroAssembler::branchArrayIsNotPacked(Register array, Register temp1,
-                                            Register temp2, Label* label) {
-  loadPtr(Address(array, NativeObject::offsetOfElements()), temp1);
-
-  // Test length == initializedLength.
-  Label done;
-  Address initLength(temp1, ObjectElements::offsetOfInitializedLength());
-  load32(Address(temp1, ObjectElements::offsetOfLength()), temp2);
-  branch32(Assembler::NotEqual, initLength, temp2, label);
-
-  // Test the NON_PACKED flag.
-  Address flags(temp1, ObjectElements::offsetOfFlags());
-  branchTest32(Assembler::NonZero, flags, Imm32(ObjectElements::NON_PACKED),
-               label);
-}
-
 void MacroAssembler::setIsPackedArray(Register obj, Register output,
                                       Register temp) {
   // Ensure it's an ArrayObject.
   Label notPackedArray;
   branchTestObjClass(Assembler::NotEqual, obj, &ArrayObject::class_, temp, obj,
                      &notPackedArray);
 
-  branchArrayIsNotPacked(obj, temp, output, &notPackedArray);
-
+  loadPtr(Address(obj, NativeObject::offsetOfElements()), temp);
+
+  // Test length == initializedLength.
   Label done;
+  Address initLength(temp, ObjectElements::offsetOfInitializedLength());
+  load32(Address(temp, ObjectElements::offsetOfLength()), output);
+  branch32(Assembler::NotEqual, initLength, output, &notPackedArray);
+
+  // Test the NON_PACKED flag.
+  Address flags(temp, ObjectElements::offsetOfFlags());
+  branchTest32(Assembler::NonZero, flags, Imm32(ObjectElements::NON_PACKED),
+               &notPackedArray);
+
   move32(Imm32(1), output);
   jump(&done);
 
   bind(&notPackedArray);
   move32(Imm32(0), output);
 
   bind(&done);
 }
--- a/js/src/jit/MacroAssembler.h
+++ b/js/src/jit/MacroAssembler.h
@@ -3608,19 +3608,16 @@ class MacroAssembler : public MacroAssem
                                const Address& dest);
 
   void memoryBarrierBefore(const Synchronization& sync);
   void memoryBarrierAfter(const Synchronization& sync);
 
   void debugAssertIsObject(const ValueOperand& val);
   void debugAssertObjHasFixedSlots(Register obj, Register scratch);
 
-  void branchArrayIsNotPacked(Register array, Register temp1, Register temp2,
-                              Label* label);
-
   void setIsPackedArray(Register obj, Register output, Register temp);
 
   void packedArrayPop(Register array, ValueOperand output, Register temp1,
                       Register temp2, Label* fail);
   void packedArrayShift(Register array, ValueOperand output, Register temp1,
                         Register temp2, LiveRegisterSet volatileRegs,
                         Label* fail);
 
--- a/js/src/jit/WarpCacheIRTranspiler.cpp
+++ b/js/src/jit/WarpCacheIRTranspiler.cpp
@@ -971,29 +971,16 @@ bool WarpCacheIRTranspiler::emitLoadInt3
 
   auto* length = MArrayLength::New(alloc(), elements);
   add(length);
 
   pushResult(length);
   return true;
 }
 
-bool WarpCacheIRTranspiler::emitLoadInt32ArrayLength(ObjOperandId objId,
-                                                     Int32OperandId resultId) {
-  MDefinition* obj = getOperand(objId);
-
-  auto* elements = MElements::New(alloc(), obj);
-  add(elements);
-
-  auto* length = MArrayLength::New(alloc(), elements);
-  add(length);
-
-  return defineOperand(resultId, length);
-}
-
 bool WarpCacheIRTranspiler::emitLoadTypedArrayLengthResult(
     ObjOperandId objId, uint32_t getterOffset) {
   MDefinition* obj = getOperand(objId);
 
   auto* length = MArrayBufferViewLength::New(alloc(), obj);
   add(length);
 
   pushResult(length);
@@ -1989,35 +1976,16 @@ bool WarpCacheIRTranspiler::emitPackedAr
   auto* ins = MArrayPopShift::New(alloc(), array, MArrayPopShift::Shift,
                                   needsHoleCheck, maybeUndefined);
   addEffectful(ins);
 
   pushResult(ins);
   return resumeAfter(ins);
 }
 
-bool WarpCacheIRTranspiler::emitPackedArraySliceResult(
-    uint32_t templateObjectOffset, ObjOperandId arrayId, Int32OperandId beginId,
-    Int32OperandId endId) {
-  JSObject* templateObj = tenuredObjectStubField(templateObjectOffset);
-
-  MDefinition* array = getOperand(arrayId);
-  MDefinition* begin = getOperand(beginId);
-  MDefinition* end = getOperand(endId);
-
-  // TODO: support pre-tenuring.
-  gc::InitialHeap heap = gc::DefaultHeap;
-
-  auto* ins = MArraySlice::New(alloc(), array, begin, end, templateObj, heap);
-  addEffectful(ins);
-
-  pushResult(ins);
-  return resumeAfter(ins);
-}
-
 bool WarpCacheIRTranspiler::emitHasClassResult(ObjOperandId objId,
                                                uint32_t claspOffset) {
   MDefinition* obj = getOperand(objId);
   const JSClass* clasp = classStubField(claspOffset);
 
   auto* hasClass = MHasClass::New(alloc(), obj, clasp);
   add(hasClass);