Backed out 3 changesets (bug 1709216) for causing multiple CacheIRCompiler failures. CLOSED TREE
authorIulian Moraru <imoraru@mozilla.com>
Fri, 07 May 2021 21:53:47 +0300
changeset 578923 7f5fd2e37da01c7596653328fa6aad75610ccff3
parent 578922 1c8d08317d52426917b76677a8510400f3d47fef
child 578924 b820b13e448e78802b358ee2556bb18d1b39102a
push id142796
push userimoraru@mozilla.com
push dateFri, 07 May 2021 18:54:51 +0000
treeherderautoland@7f5fd2e37da0 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1709216
milestone90.0a1
backs outca806eb90637cdb7f0b234731c7884af87146512
22fd0e89588075bde59a7a20245dada84d2fe4f0
205a40a5ac832c321d52fcef502f41671e12a4fd
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backed out 3 changesets (bug 1709216) for causing multiple CacheIRCompiler failures. CLOSED TREE Backed out changeset ca806eb90637 (bug 1709216) Backed out changeset 22fd0e895880 (bug 1709216) Backed out changeset 205a40a5ac83 (bug 1709216)
js/src/jit-test/tests/basic/object-is-polymorphic.js
js/src/jit/BaselineCacheIRCompiler.cpp
js/src/jit/CacheIR.cpp
js/src/jit/CacheIROps.yaml
js/src/jit/CodeGenerator.cpp
js/src/jit/IonCacheIRCompiler.cpp
js/src/jit/Lowering.cpp
js/src/jit/MIR.h
js/src/jit/VMFunctionList-inl.h
js/src/jit/WarpCacheIRTranspiler.cpp
js/src/jit/shared/LIR-shared.h
deleted file mode 100644
--- a/js/src/jit-test/tests/basic/object-is-polymorphic.js
+++ /dev/null
@@ -1,20 +0,0 @@
-function foo(arr) {
-  var result = 0;
-  for (var i = 0; i < arr.length; i++) {
-    for (var j = 0; j < arr.length; j++) {
-      if (Object.is(arr[i], arr[j])) {
-        result++;
-      }
-    }
-  }
-  return result;
-}
-
-var input = [1,"one",{x:1},
-	     1,"one",{x:1}];
-
-var sum = 0;
-for (var i = 0; i < 100; i++) {
-  sum += foo(input);
-}
-assertEq(sum, 1000);
--- a/js/src/jit/BaselineCacheIRCompiler.cpp
+++ b/js/src/jit/BaselineCacheIRCompiler.cpp
@@ -749,59 +749,16 @@ bool BaselineCacheIRCompiler::emitCompar
     stubFrame.leave(masm);
     masm.mov(ReturnReg, scratch);
   }
   masm.bind(&done);
   masm.tagValue(JSVAL_TYPE_BOOLEAN, scratch, output.valueReg());
   return true;
 }
 
-bool BaselineCacheIRCompiler::emitSameValueResult(ValOperandId lhsId,
-                                                  ValOperandId rhsId) {
-  JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
-
-  AutoOutputRegister output(*this);
-  AutoScratchRegister scratch(allocator, masm);
-  ValueOperand lhs = allocator.useValueRegister(masm, lhsId);
-  ValueOperand rhs = allocator.useValueRegister(masm, rhsId);
-
-  allocator.discardStack(masm);
-
-  Label done;
-  Label call;
-
-  // Check to see if the values have identical bits.
-  // This is correct for SameValue because SameValue(NaN,NaN) is true,
-  // and SameValue(0,-0) is false.
-  masm.branch64(Assembler::NotEqual, lhs.toRegister64(), rhs.toRegister64(),
-                &call);
-  masm.moveValue(BooleanValue(true), output.valueReg());
-  masm.jump(&done);
-
-  {
-    masm.bind(&call);
-
-    AutoStubFrame stubFrame(*this);
-    stubFrame.enter(masm, scratch);
-
-    masm.pushValue(lhs);
-    masm.pushValue(rhs);
-
-    using Fn = bool (*)(JSContext*, HandleValue, HandleValue, bool*);
-    callVM<Fn, SameValue>(masm);
-
-    stubFrame.leave(masm);
-    masm.mov(ReturnReg, scratch);
-    masm.tagValue(JSVAL_TYPE_BOOLEAN, scratch, output.valueReg());
-  }
-
-  masm.bind(&done);
-  return true;
-}
-
 bool BaselineCacheIRCompiler::emitStoreSlotShared(bool isFixed,
                                                   ObjOperandId objId,
                                                   uint32_t offsetOffset,
                                                   ValOperandId rhsId) {
   Register obj = allocator.useRegister(masm, objId);
   ValueOperand val = allocator.useValueRegister(masm, rhsId);
 
   AutoScratchRegister scratch1(allocator, masm);
--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@@ -7546,32 +7546,34 @@ AttachDecision CallIRGenerator::tryAttac
 }
 
 AttachDecision CallIRGenerator::tryAttachObjectIs(HandleFunction callee) {
   // Need two arguments.
   if (argc_ != 2) {
     return AttachDecision::NoAction;
   }
 
+  if (!isFirstStub_) {
+    // Attach only once to prevent slowdowns for polymorphic calls.
+    return AttachDecision::NoAction;
+  }
+
   // Initialize the input operand.
   Int32OperandId argcId(writer.setInputOperandId(0));
 
   // Guard callee is the `is` native function.
   emitNativeCalleeGuard(callee);
 
   ValOperandId lhsId = writer.loadArgumentFixedSlot(ArgumentKind::Arg0, argc_);
   ValOperandId rhsId = writer.loadArgumentFixedSlot(ArgumentKind::Arg1, argc_);
 
   HandleValue lhs = args_[0];
   HandleValue rhs = args_[1];
 
-  if (!isFirstStub_) {
-    writer.sameValueResult(lhsId, rhsId);
-  } else if (lhs.isNumber() && rhs.isNumber() &&
-             !(lhs.isInt32() && rhs.isInt32())) {
+  if (lhs.isNumber() && rhs.isNumber() && !(lhs.isInt32() && rhs.isInt32())) {
     NumberOperandId lhsNumId = writer.guardIsNumber(lhsId);
     NumberOperandId rhsNumId = writer.guardIsNumber(rhsId);
     writer.compareDoubleSameValueResult(lhsNumId, rhsNumId);
   } else if (!SameType(lhs, rhs)) {
     // Compare tags for strictly different types.
     ValueTagOperandId lhsTypeId = writer.loadValueTag(lhsId);
     ValueTagOperandId rhsTypeId = writer.loadValueTag(rhsId);
     writer.guardTagNotEqual(lhsTypeId, rhsTypeId);
--- a/js/src/jit/CacheIROps.yaml
+++ b/js/src/jit/CacheIROps.yaml
@@ -2561,24 +2561,16 @@
 - name: CompareDoubleSameValueResult
   shared: true
   transpile: true
   cost_estimate: 3
   args:
     lhs: NumberId
     rhs: NumberId
 
-- name: SameValueResult
-  shared: false
-  transpile: true
-  cost_estimate: 4
-  args:
-    lhs: ValId
-    rhs: ValId
-
 - name: IndirectTruncateInt32Result
   shared: true
   transpile: true
   cost_estimate: 1
   args:
     val: Int32Id
 
 - name: BigIntAsIntNResult
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -9757,47 +9757,25 @@ void CodeGenerator::visitIsNullOrLikeUnd
   Label* ifTrueLabel = getJumpLabelForBranch(ifTrue);
   Label* ifFalseLabel = getJumpLabelForBranch(ifFalse);
 
   // Objects that emulate undefined are loosely equal to null/undefined.
   Register scratch = ToRegister(lir->temp());
   testObjectEmulatesUndefined(input, ifTrueLabel, ifFalseLabel, scratch, ool);
 }
 
-void CodeGenerator::visitSameValueDouble(LSameValueDouble* lir) {
+void CodeGenerator::visitSameValueD(LSameValueD* lir) {
   FloatRegister left = ToFloatRegister(lir->left());
   FloatRegister right = ToFloatRegister(lir->right());
   FloatRegister temp = ToFloatRegister(lir->tempFloat());
   Register output = ToRegister(lir->output());
 
   masm.sameValueDouble(left, right, temp, output);
 }
 
-void CodeGenerator::visitSameValue(LSameValue* lir) {
-  ValueOperand lhs = ToValue(lir, LSameValue::LhsIndex);
-  ValueOperand rhs = ToValue(lir, LSameValue::RhsIndex);
-  Register output = ToRegister(lir->output());
-
-  Label call, done;
-
-  using Fn = bool (*)(JSContext*, HandleValue, HandleValue, bool*);
-  OutOfLineCode* ool =
-      oolCallVM<Fn, SameValue>(lir, ArgList(lhs, rhs), StoreRegisterTo(output));
-
-  // First check to see if the values have identical bits.
-  // This is correct for SameValue because SameValue(NaN,NaN) is true,
-  // and SameValue(0,-0) is false.
-  masm.branch64(Assembler::NotEqual, lhs.toRegister64(), rhs.toRegister64(),
-                ool->entry());
-  masm.move32(Imm32(1), output);
-
-  // If this fails, call SameValue.
-  masm.bind(ool->rejoin());
-}
-
 void CodeGenerator::emitConcat(LInstruction* lir, Register lhs, Register rhs,
                                Register output) {
   using Fn = JSString* (*)(JSContext*, HandleString, HandleString,
                            js::gc::InitialHeap);
   OutOfLineCode* ool = oolCallVM<Fn, ConcatStrings<CanGC>>(
       lir, ArgList(lhs, rhs, static_cast<Imm32>(gc::DefaultHeap)),
       StoreRegisterTo(output));
 
--- a/js/src/jit/IonCacheIRCompiler.cpp
+++ b/js/src/jit/IonCacheIRCompiler.cpp
@@ -2009,21 +2009,16 @@ bool IonCacheIRCompiler::emitReflectGetP
   MOZ_CRASH("Call ICs not used in ion");
 }
 
 bool IonCacheIRCompiler::emitHasClassResult(ObjOperandId objId,
                                             uint32_t claspOffset) {
   MOZ_CRASH("Call ICs not used in ion");
 }
 
-bool IonCacheIRCompiler::emitSameValueResult(ValOperandId lhs,
-                                             ValOperandId rhs) {
-  MOZ_CRASH("Call ICs not used in ion");
-}
-
 bool IonCacheIRCompiler::emitNewArrayObjectResult(uint32_t arrayLength,
                                                   uint32_t shapeOffset) {
   MOZ_CRASH("NewArray ICs not used in ion");
 }
 
 bool IonCacheIRCompiler::emitNewPlainObjectResult(uint32_t numFixedSlots,
                                                   uint32_t numDynamicSlots,
                                                   gc::AllocKind allocKind,
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -1065,40 +1065,28 @@ void LIRGenerator::visitCompare(MCompare
     define(new (alloc()) LCompareF(useRegister(left), useRegister(right)),
            comp);
     return;
   }
 
   MOZ_CRASH("Unrecognized compare type.");
 }
 
-void LIRGenerator::visitSameValueDouble(MSameValueDouble* ins) {
+void LIRGenerator::visitSameValue(MSameValue* ins) {
   MDefinition* lhs = ins->lhs();
   MDefinition* rhs = ins->rhs();
 
   MOZ_ASSERT(lhs->type() == MIRType::Double);
   MOZ_ASSERT(rhs->type() == MIRType::Double);
 
   auto* lir = new (alloc())
-      LSameValueDouble(useRegister(lhs), useRegister(rhs), tempDouble());
+      LSameValueD(useRegister(lhs), useRegister(rhs), tempDouble());
   define(lir, ins);
 }
 
-void LIRGenerator::visitSameValue(MSameValue* ins) {
-  MDefinition* lhs = ins->lhs();
-  MDefinition* rhs = ins->rhs();
-
-  MOZ_ASSERT(lhs->type() == MIRType::Value);
-  MOZ_ASSERT(rhs->type() == MIRType::Value);
-
-  auto* lir = new (alloc()) LSameValue(useBox(lhs), useBox(rhs));
-  define(lir, ins);
-  assignSafepoint(lir, ins);
-}
-
 void LIRGenerator::lowerBitOp(JSOp op, MBinaryBitwiseInstruction* ins) {
   MDefinition* lhs = ins->getOperand(0);
   MDefinition* rhs = ins->getOperand(1);
   MOZ_ASSERT(IsIntType(ins->type()));
 
   if (ins->type() == MIRType::Int32) {
     MOZ_ASSERT(lhs->type() == MIRType::Int32);
     MOZ_ASSERT(rhs->type() == MIRType::Int32);
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -2921,37 +2921,17 @@ class MCompare : public MBinaryInstructi
     if (!binaryCongruentTo(ins)) {
       return false;
     }
     return compareType() == ins->toCompare()->compareType() &&
            jsop() == ins->toCompare()->jsop();
   }
 };
 
-class MSameValueDouble : public MBinaryInstruction,
-                         public AllDoublePolicy::Data {
-  MSameValueDouble(MDefinition* left, MDefinition* right)
-      : MBinaryInstruction(classOpcode, left, right) {
-    setResultType(MIRType::Boolean);
-    setMovable();
-  }
-
- public:
-  INSTRUCTION_HEADER(SameValueDouble)
-  TRIVIAL_NEW_WRAPPERS
-
-  bool congruentTo(const MDefinition* ins) const override {
-    return congruentIfOperandsEqual(ins);
-  }
-  AliasSet getAliasSet() const override { return AliasSet::None(); }
-
-  ALLOW_CLONE(MSameValueDouble)
-};
-
-class MSameValue : public MBinaryInstruction, public BoxInputsPolicy::Data {
+class MSameValue : public MBinaryInstruction, public AllDoublePolicy::Data {
   MSameValue(MDefinition* left, MDefinition* right)
       : MBinaryInstruction(classOpcode, left, right) {
     setResultType(MIRType::Boolean);
     setMovable();
   }
 
  public:
   INSTRUCTION_HEADER(SameValue)
--- a/js/src/jit/VMFunctionList-inl.h
+++ b/js/src/jit/VMFunctionList-inl.h
@@ -219,17 +219,16 @@ namespace jit {
   _(ProxySetPropertyByValue, js::ProxySetPropertyByValue)                      \
   _(PushClassBodyEnv, js::jit::PushClassBodyEnv)                               \
   _(PushLexicalEnv, js::jit::PushLexicalEnv)                                   \
   _(PushVarEnv, js::jit::PushVarEnv)                                           \
   _(RecreateLexicalEnv, js::jit::RecreateLexicalEnv)                           \
   _(RegExpMatcherRaw, js::RegExpMatcherRaw)                                    \
   _(RegExpSearcherRaw, js::RegExpSearcherRaw)                                  \
   _(RegExpTesterRaw, js::RegExpTesterRaw)                                      \
-  _(SameValue, js::SameValue)                                                  \
   _(SetArrayLength, js::jit::SetArrayLength)                                   \
   _(SetDenseElement, js::jit::SetDenseElement)                                 \
   _(SetFunctionName, js::SetFunctionName)                                      \
   _(SetIntrinsicOperation, js::SetIntrinsicOperation)                          \
   _(SetObjectElementWithReceiver, js::SetObjectElementWithReceiver)            \
   _(SetPropertySuper, js::SetPropertySuper)                                    \
   _(StartDynamicModuleImport, js::StartDynamicModuleImport)                    \
   _(StringBigIntGreaterThanOrEqual,                                            \
--- a/js/src/jit/WarpCacheIRTranspiler.cpp
+++ b/js/src/jit/WarpCacheIRTranspiler.cpp
@@ -2644,28 +2644,16 @@ bool WarpCacheIRTranspiler::emitCompareN
   return true;
 }
 
 bool WarpCacheIRTranspiler::emitCompareDoubleSameValueResult(
     NumberOperandId lhsId, NumberOperandId rhsId) {
   MDefinition* lhs = getOperand(lhsId);
   MDefinition* rhs = getOperand(rhsId);
 
-  auto* sameValue = MSameValueDouble::New(alloc(), lhs, rhs);
-  add(sameValue);
-
-  pushResult(sameValue);
-  return true;
-}
-
-bool WarpCacheIRTranspiler::emitSameValueResult(ValOperandId lhsId,
-                                                ValOperandId rhsId) {
-  MDefinition* lhs = getOperand(lhsId);
-  MDefinition* rhs = getOperand(rhsId);
-
   auto* sameValue = MSameValue::New(alloc(), lhs, rhs);
   add(sameValue);
 
   pushResult(sameValue);
   return true;
 }
 
 bool WarpCacheIRTranspiler::emitIndirectTruncateInt32Result(
--- a/js/src/jit/shared/LIR-shared.h
+++ b/js/src/jit/shared/LIR-shared.h
@@ -1953,45 +1953,32 @@ class LIsNullOrLikeUndefinedAndBranchT
 
   MBasicBlock* ifTrue() const { return getSuccessor(0); }
   MBasicBlock* ifFalse() const { return getSuccessor(1); }
   MTest* mir() const { return mir_->toTest(); }
   MCompare* cmpMir() const { return cmpMir_; }
   const LDefinition* temp() { return getTemp(0); }
 };
 
-class LSameValueDouble : public LInstructionHelper<1, 2, 1> {
- public:
-  LIR_HEADER(SameValueDouble)
-  LSameValueDouble(const LAllocation& left, const LAllocation& right,
-                   const LDefinition& temp)
+class LSameValueD : public LInstructionHelper<1, 2, 1> {
+ public:
+  LIR_HEADER(SameValueD)
+  LSameValueD(const LAllocation& left, const LAllocation& right,
+              const LDefinition& temp)
       : LInstructionHelper(classOpcode) {
     setOperand(0, left);
     setOperand(1, right);
     setTemp(0, temp);
   }
 
   const LAllocation* left() { return getOperand(0); }
   const LAllocation* right() { return getOperand(1); }
   const LDefinition* tempFloat() { return getTemp(0); }
 };
 
-class LSameValue : public LInstructionHelper<1, 2 * BOX_PIECES, 0> {
- public:
-  LIR_HEADER(SameValue)
-  LSameValue(const LBoxAllocation& lhs, const LBoxAllocation& rhs)
-      : LInstructionHelper(classOpcode) {
-    setBoxOperand(LhsIndex, lhs);
-    setBoxOperand(RhsIndex, rhs);
-  }
-
-  static const size_t LhsIndex = 0;
-  static const size_t RhsIndex = BOX_PIECES;
-};
-
 // Not operation on an integer.
 class LNotI : public LInstructionHelper<1, 1, 0> {
  public:
   LIR_HEADER(NotI)
 
   explicit LNotI(const LAllocation& input) : LInstructionHelper(classOpcode) {
     setOperand(0, input);
   }