Backed out 2 changesets (bug 1488786) for raptor gdocs failures. CLOSED TREE
authorCsoregi Natalia <ncsoregi@mozilla.com>
Mon, 24 Sep 2018 23:19:25 +0300
changeset 437938 8bf660646ca6f18a269af9550c23d34a87140579
parent 437937 32d9dbdfae6b74ee1e1144fc65b8ab1029cb1eff
child 437939 9a37fb677b595927a56cb4f8bb981c648d769ba1
push id34707
push userebalazs@mozilla.com
push dateTue, 25 Sep 2018 09:18:36 +0000
treeherdermozilla-central@8db8a228536d [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1488786
milestone64.0a1
backs out6c5b95f8154e63b67542892a8431370e5ee58b6a
e0f7882e731604c617f3a9973ef12c0dbcb5504f
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backed out 2 changesets (bug 1488786) for raptor gdocs failures. CLOSED TREE Backed out changeset 6c5b95f8154e (bug 1488786) Backed out changeset e0f7882e7316 (bug 1488786)
js/src/jit-test/tests/cacheir/bug1488786.js
js/src/jit/BaselineCacheIRCompiler.cpp
js/src/jit/CacheIR.cpp
js/src/jit/CacheIR.h
js/src/jit/IonBuilder.cpp
js/src/jit/IonCacheIRCompiler.cpp
js/src/jit/VMFunctions.cpp
js/src/jit/VMFunctions.h
js/src/vm/NativeObject.cpp
js/src/vm/NativeObject.h
deleted file mode 100644
--- a/js/src/jit-test/tests/cacheir/bug1488786.js
+++ /dev/null
@@ -1,38 +0,0 @@
-setJitCompilerOption('ion.forceinlineCaches', 1);
-
-var A = Array(2**18);
-A[0] = "A";
-A[1] = "B";
-A[2**14] = "C";
-A[2**31-1] = "D";
-A[-1] = "E";
-
-function get_thee(a,x) {
-    return a[x];
-}
-
-// Warmup IC
-for (var i = 0; i < 30; i++) {
-    get_thee(A, i % A.length);
-}
-
-// Math.hypot currently always returns a Number, so helps
-// us ensure we're accessing the array with a Number index.
-var y = Math.hypot(1,0);
-var z = 2**31-1;
-// Ensure we handle negative indices.
-var a = -1;
-
-function test() {
-    for (var i = 0; i < 30; i++) {
-        assertEq(get_thee(A,y), "B");
-        assertEq(get_thee(A,z), "D");
-        assertEq(get_thee(A,a), "E");
-    }
-}
-test();
-
-if (!('oomTest' in this))
-    quit();
-
-oomTest(test);
--- a/js/src/jit/BaselineCacheIRCompiler.cpp
+++ b/js/src/jit/BaselineCacheIRCompiler.cpp
@@ -682,41 +682,16 @@ BaselineCacheIRCompiler::emitCallProxyHa
         }
     }
 
     stubFrame.leave(masm);
     return true;
 }
 
 bool
-BaselineCacheIRCompiler::emitCallNativeGetElementResult()
-{
-    Register obj = allocator.useRegister(masm, reader.objOperandId());
-    Register index = allocator.useRegister(masm, reader.int32OperandId());
-
-    AutoScratchRegister scratch(allocator, masm);
-
-    allocator.discardStack(masm);
-
-    AutoStubFrame stubFrame(*this);
-    stubFrame.enter(masm, scratch);
-
-    masm.Push(index);
-    masm.Push(TypedOrValueRegister(MIRType::Object, AnyRegister(obj)));
-    masm.Push(obj);
-
-    if (!callVM(masm, NativeGetElementInfo)) {
-        return false;
-    }
-
-    stubFrame.leave(masm);
-    return true;
-}
-
-bool
 BaselineCacheIRCompiler::emitLoadUnboxedPropertyResult()
 {
     AutoOutputRegister output(*this);
     Register obj = allocator.useRegister(masm, reader.objOperandId());
     AutoScratchRegisterMaybeOutput scratch(allocator, masm, output);
 
     JSValueType fieldType = reader.valueType();
     Address fieldOffset(stubAddress(reader.stubOffset()));
--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@@ -285,19 +285,16 @@ GetPropIRGenerator::tryAttachStub()
                 return true;
             }
             if (tryAttachUnboxedElementHole(obj, objId, index, indexId)) {
                 return true;
             }
             if (tryAttachArgumentsObjectArg(obj, objId, indexId)) {
                 return true;
             }
-            if (tryAttachGenericElement(obj, objId, index, indexId)) {
-                return true;
-            }
 
             trackAttached(IRGenerator::NotAttached);
             return false;
         }
 
         trackAttached(IRGenerator::NotAttached);
         return false;
     }
@@ -2341,41 +2338,16 @@ GetPropIRGenerator::tryAttachUnboxedElem
     // No monitor: We know undefined must be in the typeset already.
     writer.returnFromIC();
 
     trackAttached("UnboxedElementHole");
     return true;
 }
 
 bool
-GetPropIRGenerator::tryAttachGenericElement(HandleObject obj, ObjOperandId objId,
-                                            uint32_t index, Int32OperandId indexId)
-{
-    if (!obj->isNative()) {
-        return false;
-    }
-
-    // To allow other types to attach in the non-megamorphic case we test the specific
-    // matching native reciever; however, once megamorphic we can attach for any native
-    if (mode_ == ICState::Mode::Megamorphic) {
-        writer.guardIsNativeObject(objId);
-    } else {
-        NativeObject* nobj = &obj->as<NativeObject>();
-        TestMatchingNativeReceiver(writer, nobj, objId);
-    }
-    writer.callNativeGetElementResult(objId, indexId);
-    writer.typeMonitorResult();
-
-    trackAttached(mode_ == ICState::Mode::Megamorphic
-                  ? "GenericElementMegamorphic": "GenericElement");
-    return true;
-}
-
-
-bool
 GetPropIRGenerator::tryAttachProxyElement(HandleObject obj, ObjOperandId objId)
 {
     if (!obj->is<ProxyObject>()) {
         return false;
     }
 
     // The proxy stubs don't currently support |super| access.
     if (isSuper()) {
--- a/js/src/jit/CacheIR.h
+++ b/js/src/jit/CacheIR.h
@@ -293,17 +293,16 @@ extern const char* const CacheKindNames[
     _(LoadEnvironmentDynamicSlotResult)   \
     _(LoadObjectResult)                   \
     _(CallScriptedGetterResult)           \
     _(CallNativeGetterResult)             \
     _(CallProxyGetResult)                 \
     _(CallProxyGetByValueResult)          \
     _(CallProxyHasPropResult)             \
     _(CallObjectHasSparseElementResult)   \
-    _(CallNativeGetElementResult)        \
     _(LoadUndefinedResult)                \
     _(LoadBooleanResult)                  \
     _(LoadStringResult)                   \
     _(LoadInstanceOfObjectResult)         \
     _(LoadTypeOfObjectResult)             \
     _(DoubleAddResult)                    \
     _(DoubleSubResult)                    \
     _(DoubleMulResult)                    \
@@ -1255,20 +1254,16 @@ class MOZ_RAII CacheIRWriter : public JS
         writeOpWithOperandId(CacheOp::CallProxyHasPropResult, obj);
         writeOperandId(idVal);
         buffer_.writeByte(uint32_t(hasOwn));
     }
     void callObjectHasSparseElementResult(ObjOperandId obj, Int32OperandId index) {
         writeOpWithOperandId(CacheOp::CallObjectHasSparseElementResult, obj);
         writeOperandId(index);
     }
-    void callNativeGetElementResult(ObjOperandId obj, Int32OperandId index) {
-        writeOpWithOperandId(CacheOp::CallNativeGetElementResult, obj);
-        writeOperandId(index);
-    }
     void loadEnvironmentFixedSlotResult(ObjOperandId obj, size_t offset) {
         writeOpWithOperandId(CacheOp::LoadEnvironmentFixedSlotResult, obj);
         addStubField(offset, StubField::Type::RawWord);
     }
     void loadEnvironmentDynamicSlotResult(ObjOperandId obj, size_t offset) {
         writeOpWithOperandId(CacheOp::LoadEnvironmentDynamicSlotResult, obj);
         addStubField(offset, StubField::Type::RawWord);
     }
@@ -1569,19 +1564,16 @@ class MOZ_RAII GetPropIRGenerator : publ
                                uint32_t index, Int32OperandId indexId);
     bool tryAttachDenseElementHole(HandleObject obj, ObjOperandId objId,
                                    uint32_t index, Int32OperandId indexId);
     bool tryAttachTypedElement(HandleObject obj, ObjOperandId objId,
                                uint32_t index, Int32OperandId indexId);
     bool tryAttachUnboxedElementHole(HandleObject obj, ObjOperandId objId,
                                      uint32_t index, Int32OperandId indexId);
 
-    bool tryAttachGenericElement(HandleObject obj, ObjOperandId objId,
-                                 uint32_t index, Int32OperandId indexId);
-
     bool tryAttachProxyElement(HandleObject obj, ObjOperandId objId);
 
     void attachMegamorphicNativeSlot(ObjOperandId objId, jsid id, bool handleMissing);
 
     ValOperandId getElemKeyValueId() const {
         MOZ_ASSERT(cacheKind_ == CacheKind::GetElem || cacheKind_ == CacheKind::GetElemSuper);
         return ValOperandId(1);
     }
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -8993,27 +8993,16 @@ IonBuilder::getElemAddCache(MDefinition*
         // Always add a barrier if the index is not an int32 value, so we can
         // attach stubs for particular properties.
         if (index->type() == MIRType::Int32) {
             barrier = PropertyReadNeedsTypeBarrier(analysisContext, alloc(), constraints(), obj,
                                                    nullptr, types);
         } else {
             barrier = BarrierKind::TypeSet;
         }
-
-        // Caches can read values from prototypes, so update the barrier to
-        // reflect such possible values.
-        if (barrier != BarrierKind::TypeSet) {
-            BarrierKind protoBarrier;
-            MOZ_TRY_VAR(protoBarrier, PropertyReadOnPrototypeNeedsTypeBarrier(this, obj, nullptr, types));
-            if (protoBarrier != BarrierKind::NoBarrier) {
-                MOZ_ASSERT(barrier <= protoBarrier);
-                barrier = protoBarrier;
-            }
-        }
     } else {
         // PropertyReadNeedsTypeBarrier only accounts for object types, so for
         // now always insert a barrier if the input is not known to be an
         // object.
         barrier = BarrierKind::TypeSet;
     }
 
     // Ensure we insert a type barrier for reads from typed objects, as type
--- a/js/src/jit/IonCacheIRCompiler.cpp
+++ b/js/src/jit/IonCacheIRCompiler.cpp
@@ -1184,43 +1184,16 @@ IonCacheIRCompiler::emitCallProxyHasProp
             return false;
         }
     }
 
     masm.storeCallResultValue(output);
     return true;
 }
 
-
-bool
-IonCacheIRCompiler::emitCallNativeGetElementResult()
-{
-    AutoSaveLiveRegisters save(*this);
-    AutoOutputRegister output(*this);
-
-    Register obj = allocator.useRegister(masm, reader.objOperandId());
-    Register index = allocator.useRegister(masm, reader.int32OperandId());
-
-    allocator.discardStack(masm);
-
-    prepareVMCall(masm, save);
-
-    masm.Push(index);
-    masm.Push(TypedOrValueRegister(MIRType::Object, AnyRegister(obj)));
-    masm.Push(obj);
-
-    if (!callVM(masm, NativeGetElementInfo)) {
-        return false;
-    }
-
-    masm.storeCallResultValue(output);
-    return true;
-}
-
-
 bool
 IonCacheIRCompiler::emitLoadUnboxedPropertyResult()
 {
     AutoOutputRegister output(*this);
     Register obj = allocator.useRegister(masm, reader.objOperandId());
 
     JSValueType fieldType = reader.valueType();
     int32_t fieldOffset = int32StubField(reader.stubOffset());
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -2110,15 +2110,10 @@ const VMFunction ProxySetPropertyByValue
     FunctionInfo<ProxySetPropertyByValueFn>(ProxySetPropertyByValue, "ProxySetPropertyByValue");
 
 typedef bool (*ProxyHasFn)(JSContext*, HandleObject, HandleValue, MutableHandleValue);
 const VMFunction ProxyHasInfo = FunctionInfo<ProxyHasFn>(ProxyHas, "ProxyHas");
 
 typedef bool (*ProxyHasOwnFn)(JSContext*, HandleObject, HandleValue, MutableHandleValue);
 const VMFunction ProxyHasOwnInfo = FunctionInfo<ProxyHasOwnFn>(ProxyHasOwn, "ProxyHasOwn");
 
-typedef bool (*NativeGetElementFn)(JSContext*, HandleNativeObject, HandleValue, int32_t,
-                                   MutableHandleValue);
-const VMFunction NativeGetElementInfo =
-    FunctionInfo<NativeGetElementFn>(NativeGetElement, "NativeGetProperty");
-
 } // namespace jit
 } // namespace js
--- a/js/src/jit/VMFunctions.h
+++ b/js/src/jit/VMFunctions.h
@@ -976,17 +976,15 @@ extern const VMFunction StringSplitHelpe
 
 extern const VMFunction ProxyGetPropertyInfo;
 extern const VMFunction ProxyGetPropertyByValueInfo;
 extern const VMFunction ProxySetPropertyInfo;
 extern const VMFunction ProxySetPropertyByValueInfo;
 extern const VMFunction ProxyHasInfo;
 extern const VMFunction ProxyHasOwnInfo;
 
-extern const VMFunction NativeGetElementInfo;
-
 // TailCall VMFunctions
 extern const VMFunction DoConcatStringObjectInfo;
 
 } // namespace jit
 } // namespace js
 
 #endif /* jit_VMFunctions_h */
--- a/js/src/vm/NativeObject.cpp
+++ b/js/src/vm/NativeObject.cpp
@@ -2565,35 +2565,16 @@ js::NativeGetProperty(JSContext* cx, Han
 bool
 js::NativeGetPropertyNoGC(JSContext* cx, NativeObject* obj, const Value& receiver, jsid id, Value* vp)
 {
     AutoAssertNoException noexc(cx);
     return NativeGetPropertyInline<NoGC>(cx, obj, receiver, id, NotNameLookup, vp);
 }
 
 bool
-js::NativeGetElement(JSContext* cx, HandleNativeObject obj, HandleValue receiver,
-                     int32_t index, MutableHandleValue vp)
-{
-    RootedId id(cx);
-
-    if (MOZ_LIKELY(index >=0)) {
-        if (!IndexToId(cx, index, &id)) {
-            return false;
-        }
-    } else {
-        RootedValue indexVal(cx, Int32Value(index));
-        if (!ValueToId<CanGC>(cx, indexVal, &id)) {
-            return false;
-        }
-    }
-    return NativeGetProperty(cx, obj, receiver, id, vp);
-}
-
-bool
 js::GetNameBoundInEnvironment(JSContext* cx, HandleObject envArg, HandleId id, MutableHandleValue vp)
 {
     // Manually unwrap 'with' environments to prevent looking up @@unscopables
     // twice.
     //
     // This is unfortunate because internally, the engine does not distinguish
     // HasProperty from HasBinding: both are implemented as a HasPropertyOp
     // hook on a WithEnvironmentObject.
--- a/js/src/vm/NativeObject.h
+++ b/js/src/vm/NativeObject.h
@@ -1605,20 +1605,16 @@ NativeGetPropertyNoGC(JSContext* cx, Nat
 
 inline bool
 NativeGetProperty(JSContext* cx, HandleNativeObject obj, HandleId id, MutableHandleValue vp)
 {
     RootedValue receiver(cx, ObjectValue(*obj));
     return NativeGetProperty(cx, obj, receiver, id, vp);
 }
 
-extern bool
-NativeGetElement(JSContext* cx, HandleNativeObject obj, HandleValue reciever, int32_t index,
-                 MutableHandleValue vp);
-
 bool
 SetPropertyByDefining(JSContext* cx, HandleId id, HandleValue v, HandleValue receiver,
                       ObjectOpResult& result);
 
 bool
 SetPropertyOnProto(JSContext* cx, HandleObject obj, HandleId id, HandleValue v,
                    HandleValue receiver, ObjectOpResult& result);