Backed out changeset dee348be6685 (bug 887016)
authorTooru Fujisawa <arai_a@mac.com>
Mon, 28 Mar 2016 06:49:54 +0900
changeset 290654 fd7e704523d7138f12db889e9d92c6000ba88993
parent 290653 592fbf849342b06d080078bc654f119b023c6b58
child 290655 2081fb1b83a1dc8f1ba34fcf11bca7e621e20b9d
push id19656
push usergwagner@mozilla.com
push dateMon, 04 Apr 2016 13:43:23 +0000
treeherderb2g-inbound@e99061fde28a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs887016
milestone48.0a1
backs outdee348be668513677d339437e9fcf4d6b5b6ce01
Backed out changeset dee348be6685 (bug 887016)
js/src/builtin/RegExp.cpp
js/src/builtin/RegExp.h
js/src/jit/CodeGenerator.cpp
js/src/jit/CodeGenerator.h
js/src/jit/InlinableNatives.h
js/src/jit/IonBuilder.h
js/src/jit/Lowering.cpp
js/src/jit/Lowering.h
js/src/jit/MCallOptimize.cpp
js/src/jit/MIR.h
js/src/jit/MOpcodes.h
js/src/jit/shared/LIR-shared.h
js/src/jit/shared/LOpcodes-shared.h
js/src/vm/RegExpObject.cpp
js/src/vm/RegExpObject.h
js/src/vm/SelfHosting.cpp
--- a/js/src/builtin/RegExp.cpp
+++ b/js/src/builtin/RegExp.cpp
@@ -1099,60 +1099,8 @@ js::RegExpPrototypeOptimizableRaw(JSCont
         *result = false;
         return true;
     }
 
     cx->compartment()->regExps.setOptimizableRegExpPrototypeShape(nproto->lastProperty());
     *result = true;
     return true;
 }
-
-bool
-js::RegExpInstanceOptimizable(JSContext* cx, unsigned argc, Value* vp)
-{
-    // This can only be called from self-hosted code.
-    CallArgs args = CallArgsFromVp(argc, vp);
-    MOZ_ASSERT(args.length() == 2);
-
-    uint8_t result = false;
-    if (!RegExpInstanceOptimizableRaw(cx, &args[0].toObject(), &args[1].toObject(), &result))
-        return false;
-
-    args.rval().setBoolean(result);
-    return true;
-}
-
-bool
-js::RegExpInstanceOptimizableRaw(JSContext* cx, JSObject* rx, JSObject* proto, uint8_t* result)
-{
-    JS::AutoCheckCannotGC nogc;
-    if (!rx->isNative()) {
-        *result = false;
-        return true;
-    }
-
-    NativeObject* nobj = static_cast<NativeObject*>(rx);
-
-    Shape* shape = cx->compartment()->regExps.getOptimizableRegExpInstanceShape();
-    if (shape == nobj->lastProperty()) {
-        *result = true;
-        return true;
-    }
-
-    if (rx->hasLazyPrototype()) {
-        *result = false;
-        return true;
-    }
-
-    if (rx->getTaggedProto().toObjectOrNull() != proto) {
-        *result = false;
-        return true;
-    }
-
-    if (!RegExpObject::isInitialShape(nobj)) {
-        *result = false;
-        return true;
-    }
-
-    cx->compartment()->regExps.setOptimizableRegExpInstanceShape(nobj->lastProperty());
-    *result = true;
-    return true;
-}
--- a/js/src/builtin/RegExp.h
+++ b/js/src/builtin/RegExp.h
@@ -92,22 +92,16 @@ extern bool
 RegExpCreate(JSContext* cx, HandleValue pattern, HandleValue flags, MutableHandleValue rval);
 
 extern bool
 RegExpPrototypeOptimizable(JSContext* cx, unsigned argc, Value* vp);
 
 extern bool
 RegExpPrototypeOptimizableRaw(JSContext* cx, JSObject* proto, uint8_t* result);
 
-extern bool
-RegExpInstanceOptimizable(JSContext* cx, unsigned argc, Value* vp);
-
-extern bool
-RegExpInstanceOptimizableRaw(JSContext* cx, JSObject* rx, JSObject* proto, uint8_t* result);
-
 // RegExp ClassSpec members used in RegExpObject.cpp.
 extern bool
 regexp_construct(JSContext* cx, unsigned argc, Value* vp);
 extern const JSPropertySpec regexp_static_props[];
 extern const JSPropertySpec regexp_properties[];
 extern const JSFunctionSpec regexp_methods[];
 
 // Used in RegExpObject::isOriginalFlagGetter.
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -2030,87 +2030,16 @@ CodeGenerator::visitOutOfLineRegExpProto
     masm.load8ZeroExtend(Address(masm.getStackPointer(), 0), output);
     masm.freeStack(sizeof(void*));
 
     restoreVolatile(output);
 
     masm.jump(ool->rejoin());
 }
 
-class OutOfLineRegExpInstanceOptimizable : public OutOfLineCodeBase<CodeGenerator>
-{
-    LRegExpInstanceOptimizable* ins_;
-
-  public:
-    explicit OutOfLineRegExpInstanceOptimizable(LRegExpInstanceOptimizable* ins)
-      : ins_(ins)
-    { }
-
-    void accept(CodeGenerator* codegen) {
-        codegen->visitOutOfLineRegExpInstanceOptimizable(this);
-    }
-    LRegExpInstanceOptimizable* ins() const {
-        return ins_;
-    }
-};
-
-void
-CodeGenerator::visitRegExpInstanceOptimizable(LRegExpInstanceOptimizable* ins)
-{
-    Register object = ToRegister(ins->object());
-    Register output = ToRegister(ins->output());
-    Register temp = ToRegister(ins->temp());
-
-    OutOfLineRegExpInstanceOptimizable* ool = new(alloc()) OutOfLineRegExpInstanceOptimizable(ins);
-    addOutOfLineCode(ool, ins->mir());
-
-    masm.loadJSContext(temp);
-    masm.loadPtr(Address(temp, JSContext::offsetOfCompartment()), temp);
-    masm.loadPtr(Address(temp, JSCompartment::offsetOfRegExps()), temp);
-    masm.loadPtr(Address(temp, RegExpCompartment::offsetOfOptimizableRegExpInstanceShape()),
-                 temp);
-
-    masm.loadPtr(Address(object, JSObject::offsetOfShape()), output);
-    masm.branchPtr(Assembler::NotEqual, output, temp, ool->entry());
-    masm.move32(Imm32(0x1), output);
-
-    masm.bind(ool->rejoin());
-}
-
-void
-CodeGenerator::visitOutOfLineRegExpInstanceOptimizable(OutOfLineRegExpInstanceOptimizable* ool)
-{
-    LRegExpInstanceOptimizable* ins = ool->ins();
-    Register object = ToRegister(ins->object());
-    Register proto = ToRegister(ins->proto());
-    Register output = ToRegister(ins->output());
-    Register temp = ToRegister(ins->temp());
-
-    saveVolatile(output);
-
-    masm.reserveStack(sizeof(void*));
-    masm.moveStackPtrTo(temp);
-
-    masm.setupUnalignedABICall(output);
-    masm.loadJSContext(output);
-    masm.passABIArg(output);
-    masm.passABIArg(object);
-    masm.passABIArg(proto);
-    masm.passABIArg(temp);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, RegExpInstanceOptimizableRaw));
-    masm.branchIfFalseBool(ReturnReg, masm.exceptionLabel());
-
-    masm.load8ZeroExtend(Address(masm.getStackPointer(), 0), output);
-    masm.freeStack(sizeof(void*));
-
-    restoreVolatile(output);
-
-    masm.jump(ool->rejoin());
-}
-
 typedef JSString* (*RegExpReplaceFn)(JSContext*, HandleString, HandleObject, HandleString);
 static const VMFunction RegExpReplaceInfo = FunctionInfo<RegExpReplaceFn>(RegExpReplace);
 
 void
 CodeGenerator::visitRegExpReplace(LRegExpReplace* lir)
 {
     if (lir->replacement()->isConstant())
         pushArg(ImmGCPtr(lir->replacement()->toConstant()->toString()));
--- a/js/src/jit/CodeGenerator.h
+++ b/js/src/jit/CodeGenerator.h
@@ -44,17 +44,16 @@ class OutOfLineTypeOfV;
 class OutOfLineUpdateCache;
 class OutOfLineCallPostWriteBarrier;
 class OutOfLineCallPostWriteElementBarrier;
 class OutOfLineIsCallable;
 class OutOfLineIsConstructor;
 class OutOfLineRegExpMatcher;
 class OutOfLineRegExpTester;
 class OutOfLineRegExpPrototypeOptimizable;
-class OutOfLineRegExpInstanceOptimizable;
 class OutOfLineLambdaArrow;
 
 class CodeGenerator : public CodeGeneratorSpecific
 {
     void generateArgumentsChecks(bool bailout = true);
     bool generateBody();
 
     ConstantOrRegister toConstantOrRegister(LInstruction* lir, size_t n, MIRType type);
@@ -112,18 +111,16 @@ class CodeGenerator : public CodeGenerat
     void visitInteger64(LInteger64* lir);
     void visitRegExp(LRegExp* lir);
     void visitRegExpMatcher(LRegExpMatcher* lir);
     void visitOutOfLineRegExpMatcher(OutOfLineRegExpMatcher* ool);
     void visitRegExpTester(LRegExpTester* lir);
     void visitOutOfLineRegExpTester(OutOfLineRegExpTester* ool);
     void visitRegExpPrototypeOptimizable(LRegExpPrototypeOptimizable* lir);
     void visitOutOfLineRegExpPrototypeOptimizable(OutOfLineRegExpPrototypeOptimizable* ool);
-    void visitRegExpInstanceOptimizable(LRegExpInstanceOptimizable* lir);
-    void visitOutOfLineRegExpInstanceOptimizable(OutOfLineRegExpInstanceOptimizable* ool);
     void visitRegExpReplace(LRegExpReplace* lir);
     void visitStringReplace(LStringReplace* lir);
     void emitSharedStub(ICStub::Kind kind, LInstruction* lir);
     void visitBinarySharedStub(LBinarySharedStub* lir);
     void visitUnarySharedStub(LUnarySharedStub* lir);
     void visitLambda(LLambda* lir);
     void visitOutOfLineLambdaArrow(OutOfLineLambdaArrow* ool);
     void visitLambdaArrow(LLambdaArrow* lir);
--- a/js/src/jit/InlinableNatives.h
+++ b/js/src/jit/InlinableNatives.h
@@ -64,17 +64,16 @@
     _(MathSign)                     \
     _(MathTrunc)                    \
     _(MathCbrt)                     \
                                     \
     _(RegExpMatcher)                \
     _(RegExpTester)                 \
     _(IsRegExpObject)               \
     _(RegExpPrototypeOptimizable)   \
-    _(RegExpInstanceOptimizable)    \
                                     \
     _(String)                       \
     _(StringSplit)                  \
     _(StringCharCodeAt)             \
     _(StringFromCharCode)           \
     _(StringCharAt)                 \
     _(StringReplace)                \
                                     \
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -819,17 +819,16 @@ class IonBuilder
     InliningStatus inlineStrCharAt(CallInfo& callInfo);
     InliningStatus inlineStrReplace(CallInfo& callInfo);
 
     // RegExp intrinsics.
     InliningStatus inlineRegExpMatcher(CallInfo& callInfo);
     InliningStatus inlineRegExpTester(CallInfo& callInfo);
     InliningStatus inlineIsRegExpObject(CallInfo& callInfo);
     InliningStatus inlineRegExpPrototypeOptimizable(CallInfo& callInfo);
-    InliningStatus inlineRegExpInstanceOptimizable(CallInfo& callInfo);
 
     // Object natives and intrinsics.
     InliningStatus inlineObjectCreate(CallInfo& callInfo);
     InliningStatus inlineDefineDataProperty(CallInfo& callInfo);
 
     // Atomics natives.
     InliningStatus inlineAtomicsCompareExchange(CallInfo& callInfo);
     InliningStatus inlineAtomicsExchange(CallInfo& callInfo);
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -2291,28 +2291,16 @@ LIRGenerator::visitRegExpPrototypeOptimi
     MOZ_ASSERT(ins->object()->type() == MIRType_Object);
     MOZ_ASSERT(ins->type() == MIRType_Boolean);
     LRegExpPrototypeOptimizable* lir = new(alloc()) LRegExpPrototypeOptimizable(useRegister(ins->object()),
                                                                                 temp());
     define(lir, ins);
 }
 
 void
-LIRGenerator::visitRegExpInstanceOptimizable(MRegExpInstanceOptimizable* ins)
-{
-    MOZ_ASSERT(ins->object()->type() == MIRType_Object);
-    MOZ_ASSERT(ins->proto()->type() == MIRType_Object);
-    MOZ_ASSERT(ins->type() == MIRType_Boolean);
-    LRegExpInstanceOptimizable* lir = new(alloc()) LRegExpInstanceOptimizable(useRegister(ins->object()),
-                                                                              useRegister(ins->proto()),
-                                                                              temp());
-    define(lir, ins);
-}
-
-void
 LIRGenerator::visitRegExpReplace(MRegExpReplace* ins)
 {
     MOZ_ASSERT(ins->pattern()->type() == MIRType_Object);
     MOZ_ASSERT(ins->string()->type() == MIRType_String);
     MOZ_ASSERT(ins->replacement()->type() == MIRType_String);
 
     LRegExpReplace* lir = new(alloc()) LRegExpReplace(useRegisterOrConstantAtStart(ins->string()),
                                                       useRegisterAtStart(ins->pattern()),
--- a/js/src/jit/Lowering.h
+++ b/js/src/jit/Lowering.h
@@ -161,17 +161,16 @@ class LIRGenerator : public LIRGenerator
     void visitWrapInt64ToInt32(MWrapInt64ToInt32* ins);
     void visitExtendInt32ToInt64(MExtendInt32ToInt64* ins);
     void visitToString(MToString* convert);
     void visitToObjectOrNull(MToObjectOrNull* convert);
     void visitRegExp(MRegExp* ins);
     void visitRegExpMatcher(MRegExpMatcher* ins);
     void visitRegExpTester(MRegExpTester* ins);
     void visitRegExpPrototypeOptimizable(MRegExpPrototypeOptimizable* ins);
-    void visitRegExpInstanceOptimizable(MRegExpInstanceOptimizable* ins);
     void visitRegExpReplace(MRegExpReplace* ins);
     void visitStringReplace(MStringReplace* ins);
     void visitBinarySharedStub(MBinarySharedStub* ins);
     void visitUnarySharedStub(MUnarySharedStub* ins);
     void visitLambda(MLambda* ins);
     void visitLambdaArrow(MLambdaArrow* ins);
     void visitKeepAliveObject(MKeepAliveObject* ins);
     void visitSlots(MSlots* ins);
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -179,18 +179,16 @@ IonBuilder::inlineNativeCall(CallInfo& c
       case InlinableNative::RegExpMatcher:
         return inlineRegExpMatcher(callInfo);
       case InlinableNative::RegExpTester:
         return inlineRegExpTester(callInfo);
       case InlinableNative::IsRegExpObject:
         return inlineIsRegExpObject(callInfo);
       case InlinableNative::RegExpPrototypeOptimizable:
         return inlineRegExpPrototypeOptimizable(callInfo);
-      case InlinableNative::RegExpInstanceOptimizable:
-        return inlineRegExpInstanceOptimizable(callInfo);
 
       // String natives.
       case InlinableNative::String:
         return inlineStringObject(callInfo);
       case InlinableNative::StringSplit:
         return inlineStringSplit(callInfo);
       case InlinableNative::StringCharCodeAt:
         return inlineStrCharCodeAt(callInfo);
@@ -1907,45 +1905,16 @@ IonBuilder::inlineRegExpPrototypeOptimiz
     MInstruction* opt = MRegExpPrototypeOptimizable::New(alloc(), protoArg);
     current->add(opt);
     current->push(opt);
 
     return InliningStatus_Inlined;
 }
 
 IonBuilder::InliningStatus
-IonBuilder::inlineRegExpInstanceOptimizable(CallInfo& callInfo)
-{
-    if (callInfo.argc() != 2 || callInfo.constructing()) {
-        trackOptimizationOutcome(TrackedOutcome::CantInlineNativeBadForm);
-        return InliningStatus_NotInlined;
-    }
-
-    MDefinition* rxArg = callInfo.getArg(0);
-    MDefinition* protoArg = callInfo.getArg(1);
-
-    if (rxArg->type() != MIRType_Object)
-        return InliningStatus_NotInlined;
-
-    if (protoArg->type() != MIRType_Object)
-        return InliningStatus_NotInlined;
-
-    if (getInlineReturnType() != MIRType_Boolean)
-        return InliningStatus_NotInlined;
-
-    callInfo.setImplicitlyUsedUnchecked();
-
-    MInstruction* opt = MRegExpInstanceOptimizable::New(alloc(), rxArg, protoArg);
-    current->add(opt);
-    current->push(opt);
-
-    return InliningStatus_Inlined;
-}
-
-IonBuilder::InliningStatus
 IonBuilder::inlineStrReplace(CallInfo& callInfo)
 {
     if (callInfo.argc() != 2 || callInfo.constructing()) {
         trackOptimizationOutcome(TrackedOutcome::CantInlineNativeBadForm);
         return InliningStatus_NotInlined;
     }
 
     // Return: String.
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -8012,45 +8012,16 @@ class MRegExpPrototypeOptimizable
     MDefinition* object() const {
         return getOperand(0);
     }
     AliasSet getAliasSet() const override {
         return AliasSet::None();
     }
 };
 
-class MRegExpInstanceOptimizable
-  : public MBinaryInstruction,
-    public MixPolicy<ObjectPolicy<0>, ObjectPolicy<1> >::Data
-{
-    explicit MRegExpInstanceOptimizable(MDefinition* object, MDefinition* proto)
-      : MBinaryInstruction(object, proto)
-    {
-        setResultType(MIRType_Boolean);
-        setMovable();
-    }
-
-  public:
-    INSTRUCTION_HEADER(RegExpInstanceOptimizable)
-
-    static MRegExpInstanceOptimizable* New(TempAllocator& alloc, MDefinition* obj,
-                                           MDefinition* proto) {
-        return new(alloc) MRegExpInstanceOptimizable(obj, proto);
-    }
-    MDefinition* object() const {
-        return getOperand(0);
-    }
-    MDefinition* proto() const {
-        return getOperand(1);
-    }
-    AliasSet getAliasSet() const override {
-        return AliasSet::None();
-    }
-};
-
 template <class Policy1>
 class MStrReplace
   : public MTernaryInstruction,
     public Mix3Policy<StringPolicy<0>, Policy1, StringPolicy<2> >::Data
 {
   protected:
 
     MStrReplace(MDefinition* string, MDefinition* pattern, MDefinition* replacement)
--- a/js/src/jit/MOpcodes.h
+++ b/js/src/jit/MOpcodes.h
@@ -143,17 +143,16 @@ namespace jit {
     _(Start)                                                                \
     _(OsrEntry)                                                             \
     _(Nop)                                                                  \
     _(LimitedTruncate)                                                      \
     _(RegExp)                                                               \
     _(RegExpMatcher)                                                        \
     _(RegExpTester)                                                         \
     _(RegExpPrototypeOptimizable)                                           \
-    _(RegExpInstanceOptimizable)                                            \
     _(RegExpReplace)                                                        \
     _(StringReplace)                                                        \
     _(Lambda)                                                               \
     _(LambdaArrow)                                                          \
     _(KeepAliveObject)                                                      \
     _(Slots)                                                                \
     _(Elements)                                                             \
     _(ConstantElements)                                                     \
--- a/js/src/jit/shared/LIR-shared.h
+++ b/js/src/jit/shared/LIR-shared.h
@@ -4348,41 +4348,16 @@ class LRegExpPrototypeOptimizable : publ
     const LDefinition* temp() {
         return getTemp(0);
     }
     MRegExpPrototypeOptimizable* mir() const {
         return mir_->toRegExpPrototypeOptimizable();
     }
 };
 
-class LRegExpInstanceOptimizable : public LInstructionHelper<1, 2, 1>
-{
-  public:
-    LIR_HEADER(RegExpInstanceOptimizable);
-    explicit LRegExpInstanceOptimizable(const LAllocation& object, const LAllocation& proto,
-                                        const LDefinition& temp) {
-        setOperand(0, object);
-        setOperand(1, proto);
-        setTemp(0, temp);
-    }
-
-    const LAllocation* object() {
-        return getOperand(0);
-    }
-    const LAllocation* proto() {
-        return getOperand(1);
-    }
-    const LDefinition* temp() {
-        return getTemp(0);
-    }
-    MRegExpInstanceOptimizable* mir() const {
-        return mir_->toRegExpInstanceOptimizable();
-    }
-};
-
 class LStrReplace : public LCallInstructionHelper<1, 3, 0>
 {
   public:
     LStrReplace(const LAllocation& string, const LAllocation& pattern,
                    const LAllocation& replacement)
     {
         setOperand(0, string);
         setOperand(1, pattern);
--- a/js/src/jit/shared/LOpcodes-shared.h
+++ b/js/src/jit/shared/LOpcodes-shared.h
@@ -204,17 +204,16 @@
     _(OsrValue)                     \
     _(OsrScopeChain)                \
     _(OsrReturnValue)               \
     _(OsrArgumentsObject)           \
     _(RegExp)                       \
     _(RegExpMatcher)                \
     _(RegExpTester)                 \
     _(RegExpPrototypeOptimizable)   \
-    _(RegExpInstanceOptimizable)    \
     _(RegExpReplace)                \
     _(StringReplace)                \
     _(Substr)                       \
     _(BinarySharedStub)             \
     _(UnarySharedStub)              \
     _(Lambda)                       \
     _(LambdaArrow)                  \
     _(LambdaForSingleton)           \
--- a/js/src/vm/RegExpObject.cpp
+++ b/js/src/vm/RegExpObject.cpp
@@ -716,18 +716,17 @@ RegExpShared::sizeOfIncludingThis(mozill
     return n;
 }
 
 /* RegExpCompartment */
 
 RegExpCompartment::RegExpCompartment(JSRuntime* rt)
   : set_(rt),
     matchResultTemplateObject_(nullptr),
-    optimizableRegExpPrototypeShape_(nullptr),
-    optimizableRegExpInstanceShape_(nullptr)
+    optimizableRegExpPrototypeShape_(nullptr)
 {}
 
 RegExpCompartment::~RegExpCompartment()
 {
     // Because of stray mark bits being set (see RegExpCompartment::sweep)
     // there might still be RegExpShared instances which haven't been deleted.
     if (set_.initialized()) {
         for (Set::Enum e(set_); !e.empty(); e.popFront()) {
@@ -848,22 +847,16 @@ RegExpCompartment::sweep(JSRuntime* rt)
         matchResultTemplateObject_.set(nullptr);
     }
 
     if (optimizableRegExpPrototypeShape_ &&
         IsAboutToBeFinalized(&optimizableRegExpPrototypeShape_))
     {
         optimizableRegExpPrototypeShape_.set(nullptr);
     }
-
-    if (optimizableRegExpInstanceShape_ &&
-        IsAboutToBeFinalized(&optimizableRegExpInstanceShape_))
-    {
-        optimizableRegExpInstanceShape_.set(nullptr);
-    }
 }
 
 bool
 RegExpCompartment::get(JSContext* cx, JSAtom* source, RegExpFlag flags, RegExpGuard* g)
 {
     Key key(source, flags);
     Set::AddPtr p = set_.lookupForAdd(key);
     if (p) {
--- a/js/src/vm/RegExpObject.h
+++ b/js/src/vm/RegExpObject.h
@@ -331,23 +331,16 @@ class RegExpCompartment
      *   * RegExp.prototype.global getter is not modified
      *   * RegExp.prototype.sticky getter is not modified
      *   * RegExp.prototype.exec is an own data property
      *   * RegExp.prototype[@@match] is an own data property
      *   * RegExp.prototype[@@search] is an own data property
      */
     ReadBarriered<Shape*> optimizableRegExpPrototypeShape_;
 
-    /*
-     * The shape of RegExp instance that satisfies following:
-     *   * lastProperty is lastIndex
-     *   * prototype is RegExp.prototype
-     */
-    ReadBarriered<Shape*> optimizableRegExpInstanceShape_;
-
     ArrayObject* createMatchResultTemplateObject(JSContext* cx);
 
   public:
     explicit RegExpCompartment(JSRuntime* rt);
     ~RegExpCompartment();
 
     bool init(JSContext* cx);
     void sweep(JSRuntime* rt);
@@ -367,29 +360,20 @@ class RegExpCompartment
     }
 
     Shape* getOptimizableRegExpPrototypeShape() {
         return optimizableRegExpPrototypeShape_;
     }
     void setOptimizableRegExpPrototypeShape(Shape* shape) {
         optimizableRegExpPrototypeShape_ = shape;
     }
-    Shape* getOptimizableRegExpInstanceShape() {
-        return optimizableRegExpInstanceShape_;
-    }
-    void setOptimizableRegExpInstanceShape(Shape* shape) {
-        optimizableRegExpInstanceShape_ = shape;
-    }
 
     static size_t offsetOfOptimizableRegExpPrototypeShape() {
         return offsetof(RegExpCompartment, optimizableRegExpPrototypeShape_);
     }
-    static size_t offsetOfOptimizableRegExpInstanceShape() {
-        return offsetof(RegExpCompartment, optimizableRegExpInstanceShape_);
-    }
 
     size_t sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf);
 };
 
 class RegExpObject : public NativeObject
 {
     static const unsigned LAST_INDEX_SLOT          = 0;
     static const unsigned SOURCE_SLOT              = 1;
@@ -420,25 +404,16 @@ class RegExpObject : public NativeObject
      */
     static Shape*
     assignInitialShape(ExclusiveContext* cx, Handle<RegExpObject*> obj);
 
     /* Accessors. */
 
     static unsigned lastIndexSlot() { return LAST_INDEX_SLOT; }
 
-    static bool isInitialShape(NativeObject* nobj) {
-        Shape* shape = nobj->lastProperty();
-        if (!shape->hasSlot())
-            return false;
-        if (shape->maybeSlot() != LAST_INDEX_SLOT)
-            return false;
-        return true;
-    }
-
     const Value& getLastIndex() const { return getSlot(LAST_INDEX_SLOT); }
 
     void setLastIndex(double d) {
         setSlot(LAST_INDEX_SLOT, NumberValue(d));
     }
 
     void zeroLastIndex(ExclusiveContext* cx) {
         MOZ_ASSERT(lookupPure(cx->names().lastIndex)->writable(),
--- a/js/src/vm/SelfHosting.cpp
+++ b/js/src/vm/SelfHosting.cpp
@@ -2368,18 +2368,16 @@ static const JSFunctionSpec intrinsic_fu
           CallNonGenericSelfhostedMethod<Is<RegExpObject>>, 2,0),
     JS_INLINABLE_FN("RegExpMatcher", RegExpMatcher, 4,0,
                     RegExpMatcher),
     JS_INLINABLE_FN("RegExpTester", RegExpTester, 4,0,
                     RegExpTester),
     JS_FN("RegExpCreate", intrinsic_RegExpCreate, 2,0),
     JS_INLINABLE_FN("RegExpPrototypeOptimizable", RegExpPrototypeOptimizable, 1,0,
                     RegExpPrototypeOptimizable),
-    JS_INLINABLE_FN("RegExpInstanceOptimizable", RegExpInstanceOptimizable, 1,0,
-                    RegExpInstanceOptimizable),
 
     // See builtin/RegExp.h for descriptions of the regexp_* functions.
     JS_FN("regexp_exec_no_statics", regexp_exec_no_statics, 2,0),
     JS_FN("regexp_test_no_statics", regexp_test_no_statics, 2,0),
     JS_FN("regexp_construct", regexp_construct_self_hosting, 2,0),
 
     JS_FN("IsModule", intrinsic_IsInstanceOfBuiltin<ModuleObject>, 1, 0),
     JS_FN("CallModuleMethodIfWrapped",