Bug 1269313: IonMonkey - Use TI to break alias between instructions, r=jandem
authorHannes Verschore <hv1989@gmail.com>
Tue, 24 May 2016 07:43:20 +0200
changeset 298636 6b1e076dbcb761524022bf077eb1457b59e38e5c
parent 298635 feb13c8b708aade4acf07e520682c2a9f9328544
child 298637 f96ba14774c0750556be28f7b5c5a14365af0232
push id30281
push usercbook@mozilla.com
push dateTue, 24 May 2016 12:54:02 +0000
treeherdermozilla-central@829d3be6ba64 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1269313
milestone49.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1269313: IonMonkey - Use TI to break alias between instructions, r=jandem
js/src/jit/AliasAnalysis.cpp
js/src/jit/AliasAnalysisShared.cpp
js/src/jit/AliasAnalysisShared.h
js/src/jit/FlowAliasAnalysis.cpp
js/src/jit/Lowering.cpp
js/src/jit/MIR.cpp
js/src/jit/MIR.h
js/src/jit/ScalarReplacement.cpp
js/src/jit/arm/Lowering-arm.cpp
js/src/jit/mips-shared/Lowering-mips-shared.cpp
js/src/jit/x86-shared/Lowering-x86-shared.cpp
--- a/js/src/jit/AliasAnalysis.cpp
+++ b/js/src/jit/AliasAnalysis.cpp
@@ -190,17 +190,18 @@ AliasAnalysis::analyze()
             } else {
                 // Find the most recent store on which this instruction depends.
                 MInstruction* lastStore = firstIns;
 
                 for (AliasSetIterator iter(set); iter; iter++) {
                     MInstructionVector& aliasedStores = stores[*iter];
                     for (int i = aliasedStores.length() - 1; i >= 0; i--) {
                         MInstruction* store = aliasedStores[i];
-                        if (def->mightAlias(store) != MDefinition::AliasType::NoAlias &&
+                        if (genericMightAlias(*def, store) != MDefinition::AliasType::NoAlias &&
+                            def->mightAlias(store) != MDefinition::AliasType::NoAlias &&
                             BlockMightReach(store->block(), *block))
                         {
                             if (lastStore->id() < store->id())
                                 lastStore = store;
                             break;
                         }
                     }
                 }
@@ -237,17 +238,19 @@ AliasAnalysis::analyze()
 
                 bool hasAlias = false;
                 for (AliasSetIterator iter(set); iter; iter++) {
                     MInstructionVector& aliasedStores = stores[*iter];
                     for (int i = aliasedStores.length() - 1;; i--) {
                         MInstruction* store = aliasedStores[i];
                         if (store->id() < firstLoopIns->id())
                             break;
-                        if (ins->mightAlias(store) != MDefinition::AliasType::NoAlias) {
+                        if (genericMightAlias(ins, store) != MDefinition::AliasType::NoAlias &&
+                            ins->mightAlias(store) != MDefinition::AliasType::NoAlias)
+                        {
                             hasAlias = true;
                             IonSpewDependency(ins, store, "aliases", "store in loop body");
                             break;
                         }
                     }
                     if (hasAlias)
                         break;
                 }
--- a/js/src/jit/AliasAnalysisShared.cpp
+++ b/js/src/jit/AliasAnalysisShared.cpp
@@ -1,16 +1,18 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "jit/AliasAnalysisShared.h"
 
+#include "jit/MIR.h"
+
 namespace js {
 namespace jit {
 
 void
 AliasAnalysisShared::spewDependencyList()
 {
 #ifdef JS_JITSPEW
     if (JitSpewEnabled(JitSpew_AliasSummaries)) {
@@ -35,10 +37,149 @@ AliasAnalysisShared::spewDependencyList(
                 MDefinition::PrintOpcodeName(print, def->dependency()->op());
                 print.printf("%d\n", def->dependency()->id());
             }
         }
     }
 #endif
 }
 
+// Unwrap any slot or element to its corresponding object.
+static inline const MDefinition*
+MaybeUnwrap(const MDefinition* object)
+{
+
+    while (object->isSlots() || object->isElements() || object->isConvertElementsToDoubles() ||
+           object->isTypedArrayElements() || object->isTypedObjectElements())
+    {
+        MOZ_ASSERT(object->numOperands() == 1);
+        object = object->getOperand(0);
+    }
+
+    if (object->isConstantElements())
+        return nullptr;
+
+    return object;
+}
+
+// Get the object of any load/store. Returns nullptr if not tied to
+// an object.
+static inline const MDefinition*
+GetObject(const MDefinition* ins)
+{
+    if (!ins->getAliasSet().isStore() && !ins->getAliasSet().isLoad())
+        return nullptr;
+
+    const MDefinition* object = nullptr;
+    switch (ins->op()) {
+      case MDefinition::Op_GetPropertyCache:
+        if (!ins->toGetPropertyCache()->idempotent())
+            return nullptr;
+        object = ins->getOperand(0);
+        break;
+      case MDefinition::Op_InitializedLength:
+      case MDefinition::Op_LoadElement:
+      case MDefinition::Op_LoadUnboxedScalar:
+      case MDefinition::Op_LoadUnboxedObjectOrNull:
+      case MDefinition::Op_LoadUnboxedString:
+      case MDefinition::Op_StoreElement:
+      case MDefinition::Op_StoreUnboxedObjectOrNull:
+      case MDefinition::Op_StoreUnboxedString:
+      case MDefinition::Op_StoreUnboxedScalar:
+      case MDefinition::Op_SetInitializedLength:
+      case MDefinition::Op_ArrayLength:
+      case MDefinition::Op_SetArrayLength:
+      case MDefinition::Op_StoreElementHole:
+      case MDefinition::Op_TypedObjectDescr:
+      case MDefinition::Op_Slots:
+      case MDefinition::Op_Elements:
+      case MDefinition::Op_MaybeCopyElementsForWrite:
+      case MDefinition::Op_MaybeToDoubleElement:
+      case MDefinition::Op_UnboxedArrayLength:
+      case MDefinition::Op_UnboxedArrayInitializedLength:
+      case MDefinition::Op_IncrementUnboxedArrayInitializedLength:
+      case MDefinition::Op_SetUnboxedArrayInitializedLength:
+      case MDefinition::Op_TypedArrayLength:
+      case MDefinition::Op_SetTypedObjectOffset:
+      case MDefinition::Op_SetDisjointTypedElements:
+      case MDefinition::Op_ArrayPopShift:
+      case MDefinition::Op_ArrayPush:
+      case MDefinition::Op_ArraySlice:
+      case MDefinition::Op_LoadTypedArrayElementHole:
+      case MDefinition::Op_StoreTypedArrayElementHole:
+      case MDefinition::Op_LoadFixedSlot:
+      case MDefinition::Op_LoadFixedSlotAndUnbox:
+      case MDefinition::Op_StoreFixedSlot:
+      case MDefinition::Op_GetPropertyPolymorphic:
+      case MDefinition::Op_SetPropertyPolymorphic:
+      case MDefinition::Op_GuardShape:
+      case MDefinition::Op_GuardReceiverPolymorphic:
+      case MDefinition::Op_GuardObjectGroup:
+      case MDefinition::Op_GuardObjectIdentity:
+      case MDefinition::Op_GuardClass:
+      case MDefinition::Op_GuardUnboxedExpando:
+      case MDefinition::Op_LoadUnboxedExpando:
+      case MDefinition::Op_LoadSlot:
+      case MDefinition::Op_StoreSlot:
+      case MDefinition::Op_InArray:
+      case MDefinition::Op_LoadElementHole:
+      case MDefinition::Op_TypedArrayElements:
+      case MDefinition::Op_TypedObjectElements:
+        object = ins->getOperand(0);
+        break;
+      case MDefinition::Op_LoadTypedArrayElementStatic:
+      case MDefinition::Op_StoreTypedArrayElementStatic:
+      case MDefinition::Op_GetDOMProperty:
+      case MDefinition::Op_GetDOMMember:
+      case MDefinition::Op_Call:
+      case MDefinition::Op_Compare:
+      case MDefinition::Op_GetArgumentsObjectArg:
+      case MDefinition::Op_SetArgumentsObjectArg:
+      case MDefinition::Op_GetFrameArgument:
+      case MDefinition::Op_SetFrameArgument:
+      case MDefinition::Op_CompareExchangeTypedArrayElement:
+      case MDefinition::Op_AtomicExchangeTypedArrayElement:
+      case MDefinition::Op_AtomicTypedArrayElementBinop:
+      case MDefinition::Op_AsmJSLoadHeap:
+      case MDefinition::Op_AsmJSStoreHeap:
+      case MDefinition::Op_AsmJSCompareExchangeHeap:
+      case MDefinition::Op_AsmJSAtomicBinopHeap:
+      case MDefinition::Op_AsmJSLoadGlobalVar:
+      case MDefinition::Op_AsmJSStoreGlobalVar:
+      case MDefinition::Op_ArrayJoin:
+        return nullptr;
+      default:
+#ifdef DEBUG
+        // Crash when the default aliasSet is overriden, but when not added in the list above.
+        if (!ins->getAliasSet().isStore() || ins->getAliasSet().flags() != AliasSet::Flag::Any)
+            MOZ_CRASH("Overridden getAliasSet without updating AliasAnalysisShared GetObject");
+#endif
+
+        return nullptr;
+    }
+
+    MOZ_ASSERT(!ins->getAliasSet().isStore() || ins->getAliasSet().flags() != AliasSet::Flag::Any);
+    object = MaybeUnwrap(object);
+    MOZ_ASSERT_IF(object, object->type() == MIRType::Object);
+    return object;
+}
+
+// Generic comparing if a load aliases a store using TI information.
+MDefinition::AliasType
+AliasAnalysisShared::genericMightAlias(const MDefinition* load, const MDefinition* store)
+{
+    const MDefinition* loadObject = GetObject(load);
+    const MDefinition* storeObject = GetObject(store);
+    if (!loadObject || !storeObject)
+        return MDefinition::AliasType::MayAlias;
+
+    if (!loadObject->resultTypeSet() || !storeObject->resultTypeSet())
+        return MDefinition::AliasType::MayAlias;
+
+    if (loadObject->resultTypeSet()->objectsIntersect(storeObject->resultTypeSet()))
+        return MDefinition::AliasType::MayAlias;
+
+    return MDefinition::AliasType::NoAlias;
+}
+
+
 } // namespace jit
 } // namespace js
--- a/js/src/jit/AliasAnalysisShared.h
+++ b/js/src/jit/AliasAnalysisShared.h
@@ -26,16 +26,20 @@ class AliasAnalysisShared
       : mir(mir),
         graph_(graph)
     {}
 
     virtual MOZ_MUST_USE bool analyze() {
         return true;
     }
 
+    static MDefinition::AliasType genericMightAlias(const MDefinition* load,
+                                                    const MDefinition* store);
+
+
   protected:
     void spewDependencyList();
 
     TempAllocator& alloc() const {
         return graph_.alloc();
     }
 };
 
--- a/js/src/jit/FlowAliasAnalysis.cpp
+++ b/js/src/jit/FlowAliasAnalysis.cpp
@@ -206,22 +206,28 @@ LoadAliasesStore(MDefinition* load, MDef
     // if it aliases anything in the full loop. Which we do lateron.
     if (store->isControlInstruction())
         return true;
 
     // Check if the alias categories alias eachother.
     if ((load->getAliasSet() & store->getAliasSet()).isNone())
         return false;
 
+    // On any operation that has a specific alias category we can use TI to know
+    // the objects operating on don't intersect.
+    MDefinition::AliasType mightAlias = AliasAnalysisShared::genericMightAlias(load, store);
+    if (mightAlias == MDefinition::AliasType::NoAlias)
+        return false;
+
     // Check if the instruction might alias eachother.
-    MDefinition::AliasType type = load->mightAlias(store);
-    if (type != MDefinition::AliasType::NoAlias)
-        return true;
+    mightAlias = load->mightAlias(store);
+    if (mightAlias == MDefinition::AliasType::NoAlias)
+        return false;
 
-    return false;
+    return true;
 }
 
 #ifdef JS_JITSPEW
 static void
 DumpAliasSet(AliasSet set)
 {
     Fprinter &print = JitSpewPrinter();
 
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -3605,48 +3605,48 @@ LIRGenerator::visitGetPropertyCache(MGet
         define(lir, ins);
         assignSafepoint(lir, ins);
     }
 }
 
 void
 LIRGenerator::visitGetPropertyPolymorphic(MGetPropertyPolymorphic* ins)
 {
-    MOZ_ASSERT(ins->obj()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
 
     if (ins->type() == MIRType::Value) {
         LGetPropertyPolymorphicV* lir =
-            new(alloc()) LGetPropertyPolymorphicV(useRegister(ins->obj()));
+            new(alloc()) LGetPropertyPolymorphicV(useRegister(ins->object()));
         assignSnapshot(lir, Bailout_ShapeGuard);
         defineBox(lir, ins);
     } else {
         LDefinition maybeTemp = (ins->type() == MIRType::Double) ? temp() : LDefinition::BogusTemp();
         LGetPropertyPolymorphicT* lir =
-            new(alloc()) LGetPropertyPolymorphicT(useRegister(ins->obj()), maybeTemp);
+            new(alloc()) LGetPropertyPolymorphicT(useRegister(ins->object()), maybeTemp);
         assignSnapshot(lir, Bailout_ShapeGuard);
         define(lir, ins);
     }
 }
 
 void
 LIRGenerator::visitSetPropertyPolymorphic(MSetPropertyPolymorphic* ins)
 {
-    MOZ_ASSERT(ins->obj()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
 
     if (ins->value()->type() == MIRType::Value) {
         LSetPropertyPolymorphicV* lir =
-            new(alloc()) LSetPropertyPolymorphicV(useRegister(ins->obj()),
+            new(alloc()) LSetPropertyPolymorphicV(useRegister(ins->object()),
                                                   useBox(ins->value()),
                                                   temp());
         assignSnapshot(lir, Bailout_ShapeGuard);
         add(lir, ins);
     } else {
         LAllocation value = useRegisterOrConstant(ins->value());
         LSetPropertyPolymorphicT* lir =
-            new(alloc()) LSetPropertyPolymorphicT(useRegister(ins->obj()), value,
+            new(alloc()) LSetPropertyPolymorphicT(useRegister(ins->object()), value,
                                                   ins->value()->type(), temp());
         assignSnapshot(lir, Bailout_ShapeGuard);
         add(lir, ins);
     }
 }
 
 void
 LIRGenerator::visitBindNameCache(MBindNameCache* ins)
@@ -3667,28 +3667,28 @@ LIRGenerator::visitCallBindVar(MCallBind
 
     LCallBindVar* lir = new(alloc()) LCallBindVar(useRegister(ins->scopeChain()));
     define(lir, ins);
 }
 
 void
 LIRGenerator::visitGuardObjectIdentity(MGuardObjectIdentity* ins)
 {
-    LGuardObjectIdentity* guard = new(alloc()) LGuardObjectIdentity(useRegister(ins->obj()),
+    LGuardObjectIdentity* guard = new(alloc()) LGuardObjectIdentity(useRegister(ins->object()),
                                                                     useRegister(ins->expected()));
     assignSnapshot(guard, Bailout_ObjectIdentityOrTypeGuard);
     add(guard, ins);
-    redefine(ins, ins->obj());
+    redefine(ins, ins->object());
 }
 
 void
 LIRGenerator::visitGuardClass(MGuardClass* ins)
 {
     LDefinition t = temp();
-    LGuardClass* guard = new(alloc()) LGuardClass(useRegister(ins->obj()), t);
+    LGuardClass* guard = new(alloc()) LGuardClass(useRegister(ins->object()), t);
     assignSnapshot(guard, Bailout_ObjectIdentityOrTypeGuard);
     add(guard, ins);
 }
 
 void
 LIRGenerator::visitGuardObject(MGuardObject* ins)
 {
     // The type policy does all the work, so at this point the input
@@ -3706,49 +3706,49 @@ LIRGenerator::visitGuardString(MGuardStr
     redefine(ins, ins->input());
 }
 
 void
 LIRGenerator::visitGuardSharedTypedArray(MGuardSharedTypedArray* ins)
 {
     MOZ_ASSERT(ins->input()->type() == MIRType::Object);
     LGuardSharedTypedArray* guard =
-        new(alloc()) LGuardSharedTypedArray(useRegister(ins->obj()), temp());
+        new(alloc()) LGuardSharedTypedArray(useRegister(ins->object()), temp());
     assignSnapshot(guard, Bailout_NonSharedTypedArrayInput);
     add(guard, ins);
 }
 
 void
 LIRGenerator::visitPolyInlineGuard(MPolyInlineGuard* ins)
 {
     MOZ_ASSERT(ins->input()->type() == MIRType::Object);
     redefine(ins, ins->input());
 }
 
 void
 LIRGenerator::visitGuardReceiverPolymorphic(MGuardReceiverPolymorphic* ins)
 {
-    MOZ_ASSERT(ins->obj()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
     MOZ_ASSERT(ins->type() == MIRType::Object);
 
     LGuardReceiverPolymorphic* guard =
-        new(alloc()) LGuardReceiverPolymorphic(useRegister(ins->obj()), temp());
+        new(alloc()) LGuardReceiverPolymorphic(useRegister(ins->object()), temp());
     assignSnapshot(guard, Bailout_ShapeGuard);
     add(guard, ins);
-    redefine(ins, ins->obj());
+    redefine(ins, ins->object());
 }
 
 void
 LIRGenerator::visitGuardUnboxedExpando(MGuardUnboxedExpando* ins)
 {
     LGuardUnboxedExpando* guard =
-        new(alloc()) LGuardUnboxedExpando(useRegister(ins->obj()));
+        new(alloc()) LGuardUnboxedExpando(useRegister(ins->object()));
     assignSnapshot(guard, ins->bailoutKind());
     add(guard, ins);
-    redefine(ins, ins->obj());
+    redefine(ins, ins->object());
 }
 
 void
 LIRGenerator::visitLoadUnboxedExpando(MLoadUnboxedExpando* ins)
 {
     LLoadUnboxedExpando* lir =
         new(alloc()) LLoadUnboxedExpando(useRegisterAtStart(ins->object()));
     define(lir, ins);
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -4860,158 +4860,16 @@ MLoadUnboxedObjectOrNull::foldsTo(TempAl
         return this;
 
     if (store->offsetAdjustment() != offsetAdjustment())
         return this;
 
     return foldsToStoredValue(alloc, store->value());
 }
 
-// Gets the MDefinition* representing the source/target object's storage.
-// Usually this is just an MElements*, but sometimes there are layers
-// of indirection or inlining, which are handled elsewhere.
-static inline const MElements*
-MaybeUnwrapElements(const MDefinition* elementsOrObj)
-{
-    // Sometimes there is a level of indirection for conversion.
-    if (elementsOrObj->isConvertElementsToDoubles())
-        return MaybeUnwrapElements(elementsOrObj->toConvertElementsToDoubles()->elements());
-
-    // For inline elements, the object may be passed directly, for example as MUnbox.
-    if (elementsOrObj->type() == MIRType::Object)
-        return nullptr;
-
-    // MTypedArrayElements and MTypedObjectElements aren't handled.
-    if (!elementsOrObj->isElements())
-        return nullptr;
-
-    return elementsOrObj->toElements();
-}
-
-static inline const MDefinition*
-GetElementsObject(const MDefinition* elementsOrObj)
-{
-    if (elementsOrObj->type() == MIRType::Object)
-        return elementsOrObj;
-
-    const MDefinition* elements = MaybeUnwrapElements(elementsOrObj);
-    if (elements)
-        return elements->toElements()->input();
-
-    return nullptr;
-}
-
-// Gets the MDefinition of the target Object for the given store operation.
-static inline const MDefinition*
-GetStoreObject(const MDefinition* store)
-{
-    switch (store->op()) {
-      case MDefinition::Op_StoreElement:
-        return GetElementsObject(store->toStoreElement()->elements());
-
-      case MDefinition::Op_StoreElementHole:
-        return store->toStoreElementHole()->object();
-
-      case MDefinition::Op_StoreUnboxedObjectOrNull:
-        return GetElementsObject(store->toStoreUnboxedObjectOrNull()->elements());
-
-      case MDefinition::Op_StoreUnboxedString:
-        return GetElementsObject(store->toStoreUnboxedString()->elements());
-
-      case MDefinition::Op_StoreUnboxedScalar:
-        return GetElementsObject(store->toStoreUnboxedScalar()->elements());
-
-      default:
-        return nullptr;
-    }
-}
-
-// Implements mightAlias() logic common to all load operations.
-static MDefinition::AliasType
-GenericLoadMightAlias(const MDefinition* elementsOrObj, const MDefinition* store)
-{
-    const MElements* elements = MaybeUnwrapElements(elementsOrObj);
-    if (elements)
-        return elements->mightAlias(store);
-
-    // Unhandled Elements kind.
-    if (elementsOrObj->type() != MIRType::Object)
-        return MDefinition::AliasType::MayAlias;
-
-    // Inline storage for objects.
-    // Refer to IsValidElementsType().
-    const MDefinition* object = elementsOrObj;
-    MOZ_ASSERT(object->type() == MIRType::Object);
-    if (!object->resultTypeSet())
-        return MDefinition::AliasType::MayAlias;
-
-    const MDefinition* storeObject = GetStoreObject(store);
-    if (!storeObject)
-        return MDefinition::AliasType::MayAlias;
-    if (!storeObject->resultTypeSet())
-        return MDefinition::AliasType::MayAlias;
-
-    if (object->resultTypeSet()->objectsIntersect(storeObject->resultTypeSet()))
-        return MDefinition::AliasType::MayAlias;
-    return MDefinition::AliasType::NoAlias;
-}
-
-MDefinition::AliasType
-MElements::mightAlias(const MDefinition* store) const
-{
-    if (!input()->resultTypeSet())
-        return AliasType::MayAlias;
-
-    const MDefinition* storeObj = GetStoreObject(store);
-    if (!storeObj)
-        return AliasType::MayAlias;
-    if (!storeObj->resultTypeSet())
-        return AliasType::MayAlias;
-
-    if (input()->resultTypeSet()->objectsIntersect(storeObj->resultTypeSet()))
-        return AliasType::MayAlias;
-    return AliasType::NoAlias;
-}
-
-MDefinition::AliasType
-MLoadElement::mightAlias(const MDefinition* store) const
-{
-    return GenericLoadMightAlias(elements(), store);
-}
-
-MDefinition::AliasType
-MInitializedLength::mightAlias(const MDefinition* store) const
-{
-    return GenericLoadMightAlias(elements(), store);
-}
-
-MDefinition::AliasType
-MLoadUnboxedObjectOrNull::mightAlias(const MDefinition* store) const
-{
-    return GenericLoadMightAlias(elements(), store);
-}
-
-MDefinition::AliasType
-MLoadUnboxedString::mightAlias(const MDefinition* store) const
-{
-    return GenericLoadMightAlias(elements(), store);
-}
-
-MDefinition::AliasType
-MLoadUnboxedScalar::mightAlias(const MDefinition* store) const
-{
-    return GenericLoadMightAlias(elements(), store);
-}
-
-MDefinition::AliasType
-MUnboxedArrayInitializedLength::mightAlias(const MDefinition* store) const
-{
-    return GenericLoadMightAlias(object(), store);
-}
-
 bool
 MGuardReceiverPolymorphic::congruentTo(const MDefinition* ins) const
 {
     if (!ins->isGuardReceiverPolymorphic())
         return false;
 
     const MGuardReceiverPolymorphic* other = ins->toGuardReceiverPolymorphic();
 
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -8529,17 +8529,16 @@ class MElements
     }
     bool congruentTo(const MDefinition* ins) const override {
         return congruentIfOperandsEqual(ins) &&
                ins->toElements()->unboxed() == unboxed();
     }
     AliasSet getAliasSet() const override {
         return AliasSet::Load(AliasSet::ObjectFields);
     }
-    AliasType mightAlias(const MDefinition* store) const override;
 
     ALLOW_CLONE(MElements)
 };
 
 // A constant value for some object's typed array elements.
 class MConstantElements : public MNullaryInstruction
 {
     SharedMem<void*> value_;
@@ -8723,17 +8722,16 @@ class MInitializedLength
         return getOperand(0);
     }
     bool congruentTo(const MDefinition* ins) const override {
         return congruentIfOperandsEqual(ins);
     }
     AliasSet getAliasSet() const override {
         return AliasSet::Load(AliasSet::ObjectFields);
     }
-    AliasType mightAlias(const MDefinition* store) const override;
 
     void computeRange(TempAllocator& alloc) override;
 
     ALLOW_CLONE(MInitializedLength)
 };
 
 // Store to the initialized length in an elements header. Note the input is an
 // *index*, one less than the desired length.
@@ -8821,17 +8819,16 @@ class MUnboxedArrayInitializedLength
         return getOperand(0);
     }
     bool congruentTo(const MDefinition* ins) const override {
         return congruentIfOperandsEqual(ins);
     }
     AliasSet getAliasSet() const override {
         return AliasSet::Load(AliasSet::ObjectFields);
     }
-    AliasType mightAlias(const MDefinition* store) const override;
 
     ALLOW_CLONE(MUnboxedArrayInitializedLength)
 };
 
 // Increment the initialized length of an unboxed array object.
 class MIncrementUnboxedArrayInitializedLength
   : public MUnaryInstruction,
     public SingleObjectPolicy::Data
@@ -9453,17 +9450,16 @@ class MLoadElement
         if (offsetAdjustment() != other->offsetAdjustment())
             return false;
         return congruentIfOperandsEqual(other);
     }
     MDefinition* foldsTo(TempAllocator& alloc) override;
     AliasSet getAliasSet() const override {
         return AliasSet::Load(AliasSet::Element);
     }
-    AliasType mightAlias(const MDefinition* store) const override;
 
     ALLOW_CLONE(MLoadElement)
 };
 
 // Load a value from the elements vector for a dense native or unboxed array.
 // If the index is out-of-bounds, or the indexed slot has a hole, undefined is
 // returned instead.
 class MLoadElementHole
@@ -9610,17 +9606,16 @@ class MLoadUnboxedObjectOrNull
         if (offsetAdjustment() != other->offsetAdjustment())
             return false;
         return congruentIfOperandsEqual(other);
     }
     AliasSet getAliasSet() const override {
         return AliasSet::Load(AliasSet::UnboxedElement);
     }
     MDefinition* foldsTo(TempAllocator& alloc) override;
-    AliasType mightAlias(const MDefinition* store) const override;
 
     ALLOW_CLONE(MLoadUnboxedObjectOrNull)
 };
 
 class MLoadUnboxedString
   : public MBinaryInstruction,
     public SingleObjectPolicy::Data
 {
@@ -9660,17 +9655,16 @@ class MLoadUnboxedString
         const MLoadUnboxedString* other = ins->toLoadUnboxedString();
         if (offsetAdjustment() != other->offsetAdjustment())
             return false;
         return congruentIfOperandsEqual(ins);
     }
     AliasSet getAliasSet() const override {
         return AliasSet::Load(AliasSet::UnboxedElement);
     }
-    AliasType mightAlias(const MDefinition* store) const override;
 
     ALLOW_CLONE(MLoadUnboxedString)
 };
 
 class MStoreElementCommon
 {
     MIRType elementType_;
     bool needsBarrier_;
@@ -10268,17 +10262,16 @@ class MLoadUnboxedScalar
     }
     AliasSet getAliasSet() const override {
         // When a barrier is needed make the instruction effectful by
         // giving it a "store" effect.
         if (requiresBarrier_)
             return AliasSet::Store(AliasSet::UnboxedElement);
         return AliasSet::Load(AliasSet::UnboxedElement);
     }
-    AliasType mightAlias(const MDefinition* store) const override;
 
     bool congruentTo(const MDefinition* ins) const override {
         if (requiresBarrier_)
             return false;
         if (!ins->isLoadUnboxedScalar())
             return false;
         const MLoadUnboxedScalar* other = ins->toLoadUnboxedScalar();
         if (storageType_ != other->storageType_)
@@ -11145,17 +11138,17 @@ class MGetPropertyPolymorphic
         return receivers_[i].receiver;
     }
     Shape* shape(size_t i) const {
         return receivers_[i].shape;
     }
     PropertyName* name() const {
         return name_;
     }
-    MDefinition* obj() const {
+    MDefinition* object() const {
         return getOperand(0);
     }
     AliasSet getAliasSet() const override {
         bool hasUnboxedLoad = false;
         for (size_t i = 0; i < numReceivers(); i++) {
             if (!shape(i)) {
                 hasUnboxedLoad = true;
                 break;
@@ -11218,17 +11211,17 @@ class MSetPropertyPolymorphic
         return receivers_[i].receiver;
     }
     Shape* shape(size_t i) const {
         return receivers_[i].shape;
     }
     PropertyName* name() const {
         return name_;
     }
-    MDefinition* obj() const {
+    MDefinition* object() const {
         return getOperand(0);
     }
     MDefinition* value() const {
         return getOperand(1);
     }
     bool needsBarrier() const {
         return needsBarrier_;
     }
@@ -11504,17 +11497,17 @@ class MGuardShape
     INSTRUCTION_HEADER(GuardShape)
 
     static MGuardShape* New(TempAllocator& alloc, MDefinition* obj, Shape* shape,
                             BailoutKind bailoutKind)
     {
         return new(alloc) MGuardShape(obj, shape, bailoutKind);
     }
 
-    MDefinition* obj() const {
+    MDefinition* object() const {
         return getOperand(0);
     }
     const Shape* shape() const {
         return shape_;
     }
     BailoutKind bailoutKind() const {
         return bailoutKind_;
     }
@@ -11551,17 +11544,17 @@ class MGuardReceiverPolymorphic
 
   public:
     INSTRUCTION_HEADER(GuardReceiverPolymorphic)
 
     static MGuardReceiverPolymorphic* New(TempAllocator& alloc, MDefinition* obj) {
         return new(alloc) MGuardReceiverPolymorphic(alloc, obj);
     }
 
-    MDefinition* obj() const {
+    MDefinition* object() const {
         return getOperand(0);
     }
 
     bool addReceiver(const ReceiverGuard& receiver) {
         return receivers_.append(receiver);
     }
     size_t numReceivers() const {
         return receivers_.length();
@@ -11606,17 +11599,17 @@ class MGuardObjectGroup
   public:
     INSTRUCTION_HEADER(GuardObjectGroup)
 
     static MGuardObjectGroup* New(TempAllocator& alloc, MDefinition* obj, ObjectGroup* group,
                                   bool bailOnEquality, BailoutKind bailoutKind) {
         return new(alloc) MGuardObjectGroup(obj, group, bailOnEquality, bailoutKind);
     }
 
-    MDefinition* obj() const {
+    MDefinition* object() const {
         return getOperand(0);
     }
     const ObjectGroup* group() const {
         return group_;
     }
     bool bailOnEquality() const {
         return bailOnEquality_;
     }
@@ -11658,17 +11651,17 @@ class MGuardObjectIdentity
   public:
     INSTRUCTION_HEADER(GuardObjectIdentity)
 
     static MGuardObjectIdentity* New(TempAllocator& alloc, MDefinition* obj, MDefinition* expected,
                                      bool bailOnEquality) {
         return new(alloc) MGuardObjectIdentity(obj, expected, bailOnEquality);
     }
 
-    MDefinition* obj() const {
+    MDefinition* object() const {
         return getOperand(0);
     }
     MDefinition* expected() const {
         return getOperand(1);
     }
     bool bailOnEquality() const {
         return bailOnEquality_;
     }
@@ -11701,17 +11694,17 @@ class MGuardClass
 
   public:
     INSTRUCTION_HEADER(GuardClass)
 
     static MGuardClass* New(TempAllocator& alloc, MDefinition* obj, const Class* clasp) {
         return new(alloc) MGuardClass(obj, clasp);
     }
 
-    MDefinition* obj() const {
+    MDefinition* object() const {
         return getOperand(0);
     }
     const Class* getClass() const {
         return class_;
     }
     bool congruentTo(const MDefinition* ins) const override {
         if (!ins->isGuardClass())
             return false;
@@ -11747,17 +11740,17 @@ class MGuardUnboxedExpando
   public:
     INSTRUCTION_HEADER(GuardUnboxedExpando)
 
     static MGuardUnboxedExpando* New(TempAllocator& alloc, MDefinition* obj,
                                      bool requireExpando, BailoutKind bailoutKind) {
         return new(alloc) MGuardUnboxedExpando(obj, requireExpando, bailoutKind);
     }
 
-    MDefinition* obj() const {
+    MDefinition* object() const {
         return getOperand(0);
     }
     bool requireExpando() const {
         return requireExpando_;
     }
     BailoutKind bailoutKind() const {
         return bailoutKind_;
     }
@@ -12358,17 +12351,17 @@ class MSetDOMProperty
     {
         return new(alloc) MSetDOMProperty(func, obj, val);
     }
 
     JSJitSetterOp fun() const {
         return func_;
     }
 
-    MDefinition* object() {
+    MDefinition* object() const {
         return getOperand(0);
     }
 
     MDefinition* value()
     {
         return getOperand(1);
     }
 
@@ -12460,17 +12453,17 @@ class MGetDOMProperty
     }
     size_t domMemberSlotIndex() const {
         MOZ_ASSERT(info_->isAlwaysInSlot || info_->isLazilyCachedInSlot);
         return info_->slotIndex;
     }
     bool valueMayBeInSlot() const {
         return info_->isLazilyCachedInSlot;
     }
-    MDefinition* object() {
+    MDefinition* object() const {
         return getOperand(0);
     }
 
     bool congruentTo(const MDefinition* ins) const override {
         if (!ins->isGetDOMProperty())
             return false;
 
         return congruentTo(ins->toGetDOMProperty());
@@ -13905,17 +13898,17 @@ class MGuardSharedTypedArray
     }
 
 public:
     INSTRUCTION_HEADER(GuardSharedTypedArray)
 
     static MGuardSharedTypedArray* New(TempAllocator& alloc, MDefinition* obj) {
         return new(alloc) MGuardSharedTypedArray(obj);
     }
-    MDefinition* obj() const {
+    MDefinition* object() const {
         return getOperand(0);
     }
     AliasSet getAliasSet() const override {
         return AliasSet::None();
     }
 };
 
 class MCompareExchangeTypedArrayElement
--- a/js/src/jit/ScalarReplacement.cpp
+++ b/js/src/jit/ScalarReplacement.cpp
@@ -560,17 +560,17 @@ ObjectMemoryView::visitPostWriteBarrier(
 
 void
 ObjectMemoryView::visitStoreSlot(MStoreSlot* ins)
 {
     // Skip stores made on other objects.
     MSlots* slots = ins->slots()->toSlots();
     if (slots->object() != obj_) {
         // Guard objects are replaced when they are visited.
-        MOZ_ASSERT(!slots->object()->isGuardShape() || slots->object()->toGuardShape()->obj() != obj_);
+        MOZ_ASSERT(!slots->object()->isGuardShape() || slots->object()->toGuardShape()->object() != obj_);
         return;
     }
 
     // Clone the state and update the slot value.
     if (state_->hasDynamicSlot(ins->slot())) {
         state_ = BlockState::Copy(alloc_, state_);
         if (!state_) {
             oom_ = true;
@@ -592,17 +592,17 @@ ObjectMemoryView::visitStoreSlot(MStoreS
 
 void
 ObjectMemoryView::visitLoadSlot(MLoadSlot* ins)
 {
     // Skip loads made on other objects.
     MSlots* slots = ins->slots()->toSlots();
     if (slots->object() != obj_) {
         // Guard objects are replaced when they are visited.
-        MOZ_ASSERT(!slots->object()->isGuardShape() || slots->object()->toGuardShape()->obj() != obj_);
+        MOZ_ASSERT(!slots->object()->isGuardShape() || slots->object()->toGuardShape()->object() != obj_);
         return;
     }
 
     // Replace load by the slot value.
     if (state_->hasDynamicSlot(ins->slot())) {
         ins->replaceAllUsesWith(state_->getDynamicSlot(ins->slot()));
     } else {
         // UnsafeGetReserveSlot can access baked-in slots which are guarded by
@@ -615,17 +615,17 @@ ObjectMemoryView::visitLoadSlot(MLoadSlo
     // Remove original instruction.
     ins->block()->discard(ins);
 }
 
 void
 ObjectMemoryView::visitGuardShape(MGuardShape* ins)
 {
     // Skip loads made on other objects.
-    if (ins->obj() != obj_)
+    if (ins->object() != obj_)
         return;
 
     // Replace the shape guard by its object.
     ins->replaceAllUsesWith(obj_);
 
     // Remove original instruction.
     ins->block()->discard(ins);
 }
--- a/js/src/jit/arm/Lowering-arm.cpp
+++ b/js/src/jit/arm/Lowering-arm.cpp
@@ -372,35 +372,35 @@ LIRGeneratorARM::newLTableSwitchV(MTable
 {
     return new(alloc()) LTableSwitchV(useBox(tableswitch->getOperand(0)),
                                       temp(), tempDouble(), tableswitch);
 }
 
 void
 LIRGeneratorARM::visitGuardShape(MGuardShape* ins)
 {
-    MOZ_ASSERT(ins->obj()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
 
     LDefinition tempObj = temp(LDefinition::OBJECT);
-    LGuardShape* guard = new(alloc()) LGuardShape(useRegister(ins->obj()), tempObj);
+    LGuardShape* guard = new(alloc()) LGuardShape(useRegister(ins->object()), tempObj);
     assignSnapshot(guard, ins->bailoutKind());
     add(guard, ins);
-    redefine(ins, ins->obj());
+    redefine(ins, ins->object());
 }
 
 void
 LIRGeneratorARM::visitGuardObjectGroup(MGuardObjectGroup* ins)
 {
-    MOZ_ASSERT(ins->obj()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
 
     LDefinition tempObj = temp(LDefinition::OBJECT);
-    LGuardObjectGroup* guard = new(alloc()) LGuardObjectGroup(useRegister(ins->obj()), tempObj);
+    LGuardObjectGroup* guard = new(alloc()) LGuardObjectGroup(useRegister(ins->object()), tempObj);
     assignSnapshot(guard, ins->bailoutKind());
     add(guard, ins);
-    redefine(ins, ins->obj());
+    redefine(ins, ins->object());
 }
 
 void
 LIRGeneratorARM::lowerUrshD(MUrsh* mir)
 {
     MDefinition* lhs = mir->lhs();
     MDefinition* rhs = mir->rhs();
 
--- a/js/src/jit/mips-shared/Lowering-mips-shared.cpp
+++ b/js/src/jit/mips-shared/Lowering-mips-shared.cpp
@@ -221,35 +221,35 @@ LIRGeneratorMIPSShared::newLTableSwitchV
 {
     return new(alloc()) LTableSwitchV(useBox(tableswitch->getOperand(0)),
                                       temp(), tempDouble(), temp(), tableswitch);
 }
 
 void
 LIRGeneratorMIPSShared::visitGuardShape(MGuardShape* ins)
 {
-    MOZ_ASSERT(ins->obj()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
 
     LDefinition tempObj = temp(LDefinition::OBJECT);
-    LGuardShape* guard = new(alloc()) LGuardShape(useRegister(ins->obj()), tempObj);
+    LGuardShape* guard = new(alloc()) LGuardShape(useRegister(ins->object()), tempObj);
     assignSnapshot(guard, ins->bailoutKind());
     add(guard, ins);
-    redefine(ins, ins->obj());
+    redefine(ins, ins->object());
 }
 
 void
 LIRGeneratorMIPSShared::visitGuardObjectGroup(MGuardObjectGroup* ins)
 {
-    MOZ_ASSERT(ins->obj()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
 
     LDefinition tempObj = temp(LDefinition::OBJECT);
-    LGuardObjectGroup* guard = new(alloc()) LGuardObjectGroup(useRegister(ins->obj()), tempObj);
+    LGuardObjectGroup* guard = new(alloc()) LGuardObjectGroup(useRegister(ins->object()), tempObj);
     assignSnapshot(guard, ins->bailoutKind());
     add(guard, ins);
-    redefine(ins, ins->obj());
+    redefine(ins, ins->object());
 }
 
 void
 LIRGeneratorMIPSShared::lowerUrshD(MUrsh* mir)
 {
     MDefinition* lhs = mir->lhs();
     MDefinition* rhs = mir->rhs();
 
--- a/js/src/jit/x86-shared/Lowering-x86-shared.cpp
+++ b/js/src/jit/x86-shared/Lowering-x86-shared.cpp
@@ -31,33 +31,33 @@ LIRGeneratorX86Shared::newLTableSwitchV(
 {
     return new(alloc()) LTableSwitchV(useBox(tableswitch->getOperand(0)),
                                       temp(), tempDouble(), temp(), tableswitch);
 }
 
 void
 LIRGeneratorX86Shared::visitGuardShape(MGuardShape* ins)
 {
-    MOZ_ASSERT(ins->obj()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
 
-    LGuardShape* guard = new(alloc()) LGuardShape(useRegisterAtStart(ins->obj()));
+    LGuardShape* guard = new(alloc()) LGuardShape(useRegisterAtStart(ins->object()));
     assignSnapshot(guard, ins->bailoutKind());
     add(guard, ins);
-    redefine(ins, ins->obj());
+    redefine(ins, ins->object());
 }
 
 void
 LIRGeneratorX86Shared::visitGuardObjectGroup(MGuardObjectGroup* ins)
 {
-    MOZ_ASSERT(ins->obj()->type() == MIRType::Object);
+    MOZ_ASSERT(ins->object()->type() == MIRType::Object);
 
-    LGuardObjectGroup* guard = new(alloc()) LGuardObjectGroup(useRegisterAtStart(ins->obj()));
+    LGuardObjectGroup* guard = new(alloc()) LGuardObjectGroup(useRegisterAtStart(ins->object()));
     assignSnapshot(guard, ins->bailoutKind());
     add(guard, ins);
-    redefine(ins, ins->obj());
+    redefine(ins, ins->object());
 }
 
 void
 LIRGeneratorX86Shared::visitPowHalf(MPowHalf* ins)
 {
     MDefinition* input = ins->input();
     MOZ_ASSERT(input->type() == MIRType::Double);
     LPowHalfD* lir = new(alloc()) LPowHalfD(useRegisterAtStart(input));