Bug 1479603 - [Part 1] Cleanup IC code as we show SharedICs the door. r=jandem
authorMatthew Gaudet <mgaudet@mozilla.com>
Wed, 15 Aug 2018 17:54:31 -0700
changeset 831129 7518b4bbc6c740d8f63c1cfaf765c9e136b6c011
parent 831128 fe72a77d866db978bddf7f008d5bd2863613bb02
child 831130 402c68b550d1aede856016eee0325f2c4cd75729
push id118868
push userbmo:zjz@zjz.name
push dateFri, 24 Aug 2018 07:04:39 +0000
reviewersjandem
bugs1479603
milestone63.0a1
Bug 1479603 - [Part 1] Cleanup IC code as we show SharedICs the door. r=jandem - Move SimpleTypeDescrKey functions into CacheIR.h. This matches the set of callers - Move LoadTypedThingData into CacheIRCompiler, matching usage - Push definition of StripPreliminaryObjectStubs up in file, and remove header declaration - Consolidate LoadTypedThingLength into CacheIR files - Remove now dead ICMultiStubCompiler - Remove BinarySharedStub classes. Can do this now that Compare and BinaryArith ICs have been converted to CacheIR - Rename comapreSharedStub, and use correct flag to disable it. - Remove SharedStubInfo - Collapse SharedICList.h back into SharedIC.h - Remove unimplemented declaration
js/src/jit/BaselineIC.cpp
js/src/jit/BaselineICList.h
js/src/jit/CacheIR.h
js/src/jit/CacheIRCompiler.cpp
js/src/jit/CacheIRCompiler.h
js/src/jit/CodeGenerator.cpp
js/src/jit/IonBuilder.cpp
js/src/jit/Lowering.cpp
js/src/jit/MIR.h
js/src/jit/SharedIC.cpp
js/src/jit/SharedIC.h
js/src/jit/SharedICList.h
js/src/jit/shared/LIR-shared.h
js/src/jit/shared/Lowering-shared-inl.h
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -543,16 +543,38 @@ ICToNumber_Fallback::Compiler::generateS
 
     // Push arguments.
     masm.pushValue(R0);
     masm.push(ICStubReg);
 
     return tailCallVM(DoToNumberFallbackInfo, masm);
 }
 
+static void
+StripPreliminaryObjectStubs(JSContext* cx, ICFallbackStub* stub)
+{
+    // Before the new script properties analysis has been performed on a type,
+    // all instances of that type have the maximum number of fixed slots.
+    // Afterwards, the objects (even the preliminary ones) might be changed
+    // to reduce the number of fixed slots they have. If we generate stubs for
+    // both the old and new number of fixed slots, the stub will look
+    // polymorphic to IonBuilder when it is actually monomorphic. To avoid
+    // this, strip out any stubs for preliminary objects before attaching a new
+    // stub which isn't on a preliminary object.
+
+    for (ICStubIterator iter = stub->beginChain(); !iter.atEnd(); iter++) {
+        if (iter->isCacheIR_Regular() && iter->toCacheIR_Regular()->hasPreliminaryObject())
+            iter.unlink(cx);
+        else if (iter->isCacheIR_Monitored() && iter->toCacheIR_Monitored()->hasPreliminaryObject())
+            iter.unlink(cx);
+        else if (iter->isCacheIR_Updated() && iter->toCacheIR_Updated()->hasPreliminaryObject())
+            iter.unlink(cx);
+    }
+}
+
 //
 // GetElem_Fallback
 //
 
 static bool
 DoGetElemFallback(JSContext* cx, BaselineFrame* frame, ICGetElem_Fallback* stub_, HandleValue lhs,
                   HandleValue rhs, MutableHandleValue res)
 {
@@ -760,32 +782,16 @@ ICGetElem_Fallback::Compiler::generateSt
     masm.pushValue(R1);
     masm.pushValue(R0);
     masm.push(ICStubReg);
     pushStubPayload(masm, R0.scratchReg());
 
     return tailCallVM(DoGetElemFallbackInfo, masm);
 }
 
-void
-LoadTypedThingLength(MacroAssembler& masm, TypedThingLayout layout, Register obj, Register result)
-{
-    switch (layout) {
-      case Layout_TypedArray:
-        masm.unboxInt32(Address(obj, TypedArrayObject::lengthOffset()), result);
-        break;
-      case Layout_OutlineTypedObject:
-      case Layout_InlineTypedObject:
-        masm.loadTypedObjectLength(obj, result);
-        break;
-      default:
-        MOZ_CRASH();
-    }
-}
-
 static void
 SetUpdateStubData(ICCacheIR_Updated* stub, const PropertyTypeCheckInfo* info)
 {
     if (info->isSet()) {
         stub->updateStubGroup() = info->group();
         stub->updateStubId() = info->id();
     }
 }
@@ -1428,38 +1434,16 @@ ICGetIntrinsic_Fallback::Compiler::gener
 
     return tailCallVM(DoGetIntrinsicFallbackInfo, masm);
 }
 
 //
 // GetProp_Fallback
 //
 
-void
-StripPreliminaryObjectStubs(JSContext* cx, ICFallbackStub* stub)
-{
-    // Before the new script properties analysis has been performed on a type,
-    // all instances of that type have the maximum number of fixed slots.
-    // Afterwards, the objects (even the preliminary ones) might be changed
-    // to reduce the number of fixed slots they have. If we generate stubs for
-    // both the old and new number of fixed slots, the stub will look
-    // polymorphic to IonBuilder when it is actually monomorphic. To avoid
-    // this, strip out any stubs for preliminary objects before attaching a new
-    // stub which isn't on a preliminary object.
-
-    for (ICStubIterator iter = stub->beginChain(); !iter.atEnd(); iter++) {
-        if (iter->isCacheIR_Regular() && iter->toCacheIR_Regular()->hasPreliminaryObject())
-            iter.unlink(cx);
-        else if (iter->isCacheIR_Monitored() && iter->toCacheIR_Monitored()->hasPreliminaryObject())
-            iter.unlink(cx);
-        else if (iter->isCacheIR_Updated() && iter->toCacheIR_Updated()->hasPreliminaryObject())
-            iter.unlink(cx);
-    }
-}
-
 static bool
 ComputeGetPropResult(JSContext* cx, BaselineFrame* frame, JSOp op, HandlePropertyName name,
                      MutableHandleValue val, MutableHandleValue res)
 {
     // Handle arguments.length and arguments.callee on optimized arguments, as
     // it is not an object.
     if (val.isMagic(JS_OPTIMIZED_ARGUMENTS) && IsOptimizedArguments(frame, val)) {
         if (op == JSOP_LENGTH) {
@@ -5187,43 +5171,40 @@ ICNewArray_Fallback::Compiler::generateS
 
     return tailCallVM(DoNewArrayInfo, masm);
 }
 
 //
 // NewObject_Fallback
 //
 static bool
-DoNewObject(JSContext* cx, void* payload, ICNewObject_Fallback* stub, MutableHandleValue res)
+DoNewObject(JSContext* cx, BaselineFrame* frame, ICNewObject_Fallback* stub, MutableHandleValue res)
 {
-    SharedStubInfo info(cx, payload, stub->icEntry());
-
     FallbackICSpew(cx, stub, "NewObject");
 
     RootedObject obj(cx);
 
     RootedObject templateObject(cx, stub->templateObject());
     if (templateObject) {
         MOZ_ASSERT(!templateObject->group()->maybePreliminaryObjectsDontCheckGeneration());
         obj = NewObjectOperationWithTemplate(cx, templateObject);
     } else {
-        HandleScript script = info.script();
-        jsbytecode* pc = info.pc();
+        RootedScript script(cx, frame->script());
+        jsbytecode* pc = stub->icEntry()->pc(script);
         obj = NewObjectOperation(cx, script, pc);
 
         if (obj && !obj->isSingleton() &&
             !obj->group()->maybePreliminaryObjectsDontCheckGeneration())
         {
             templateObject = NewObjectOperation(cx, script, pc, TenuredObject);
             if (!templateObject)
                 return false;
 
             if (!JitOptions.disableCacheIR) {
                 bool attached = false;
-                RootedScript script(cx, info.outerScript(cx));
                 NewObjectIRGenerator gen(cx, script, pc, stub->state().mode(), JSOp(*pc), templateObject);
                 if (gen.tryAttachStub()) {
                     ICStub* newStub = AttachBaselineCacheIRStub(cx, gen.writerRef(), gen.cacheKind(),
                                                                 BaselineCacheIRStubKind::Regular,
                                                                 ICStubEngine::Baseline , script, stub, &attached);
                     if (newStub)
                         JitSpew(JitSpew_BaselineIC, "  NewObject Attached CacheIR stub");
                 }
@@ -5234,17 +5215,17 @@ DoNewObject(JSContext* cx, void* payload
 
     if (!obj)
         return false;
 
     res.setObject(*obj);
     return true;
 }
 
-typedef bool(*DoNewObjectFn)(JSContext*, void*, ICNewObject_Fallback*, MutableHandleValue);
+typedef bool(*DoNewObjectFn)(JSContext*, BaselineFrame*, ICNewObject_Fallback*, MutableHandleValue);
 static const VMFunction DoNewObjectInfo =
     FunctionInfo<DoNewObjectFn>(DoNewObject, "DoNewObject", TailCall);
 
 bool
 ICNewObject_Fallback::Compiler::generateStubCode(MacroAssembler& masm)
 {
     EmitRestoreTailCallReg(masm);
 
--- a/js/src/jit/BaselineICList.h
+++ b/js/src/jit/BaselineICList.h
@@ -70,15 +70,25 @@ namespace jit {
                                                  \
     _(InstanceOf_Fallback)                       \
     _(InstanceOf_Function)                       \
                                                  \
     _(TypeOf_Fallback)                           \
                                                  \
     _(Rest_Fallback)                             \
                                                  \
+    _(BinaryArith_Fallback)                      \
+                                                 \
+    _(Compare_Fallback)                          \
+                                                 \
+    _(GetProp_Fallback)                          \
+                                                 \
     _(RetSub_Fallback)                           \
-    _(RetSub_Resume)
+    _(RetSub_Resume)                             \
+                                                 \
+    _(CacheIR_Regular)                           \
+    _(CacheIR_Monitored)                         \
+    _(CacheIR_Updated)                           \
 
 } // namespace jit
 } // namespace js
  
 #endif /* jit_BaselineICList_h */
--- a/js/src/jit/CacheIR.h
+++ b/js/src/jit/CacheIR.h
@@ -417,16 +417,23 @@ enum class GuardClassKind : uint8_t
 };
 
 // Some ops refer to shapes that might be in other zones. Instead of putting
 // cross-zone pointers in the caches themselves (which would complicate tracing
 // enormously), these ops instead contain wrappers for objects in the target
 // zone, which refer to the actual shape via a reserved slot.
 JSObject* NewWrapperWithObjectShape(JSContext* cx, HandleNativeObject obj);
 
+// Enum for stubs handling a combination of typed arrays and typed objects.
+enum TypedThingLayout {
+    Layout_TypedArray,
+    Layout_OutlineTypedObject,
+    Layout_InlineTypedObject
+};
+
 void LoadShapeWrapperContents(MacroAssembler& masm, Register obj, Register dst, Label* failure);
 
 // Class to record CacheIR + some additional metadata for code generation.
 class MOZ_RAII CacheIRWriter : public JS::CustomAutoRooter
 {
     JSContext* cx_;
     CompactBufferWriter buffer_;
 
@@ -1971,12 +1978,41 @@ class MOZ_RAII NewObjectIRGenerator : pu
 
   public:
     NewObjectIRGenerator(JSContext* cx, HandleScript, jsbytecode* pc, ICState::Mode,
                          JSOp op, HandleObject templateObj);
 
     bool tryAttachStub();
 };
 
+static inline uint32_t
+SimpleTypeDescrKey(SimpleTypeDescr* descr)
+{
+    if (descr->is<ScalarTypeDescr>())
+        return uint32_t(descr->as<ScalarTypeDescr>().type()) << 1;
+    return (uint32_t(descr->as<ReferenceTypeDescr>().type()) << 1) | 1;
+}
+
+inline bool
+SimpleTypeDescrKeyIsScalar(uint32_t key)
+{
+    return !(key & 1);
+}
+
+inline ScalarTypeDescr::Type
+ScalarTypeFromSimpleTypeDescrKey(uint32_t key)
+{
+    MOZ_ASSERT(SimpleTypeDescrKeyIsScalar(key));
+    return ScalarTypeDescr::Type(key >> 1);
+}
+
+inline ReferenceType
+ReferenceTypeFromSimpleTypeDescrKey(uint32_t key)
+{
+    MOZ_ASSERT(!SimpleTypeDescrKeyIsScalar(key));
+    return ReferenceType(key >> 1);
+}
+
+
 } // namespace jit
 } // namespace js
 
 #endif /* jit_CacheIR_h */
--- a/js/src/jit/CacheIRCompiler.cpp
+++ b/js/src/jit/CacheIRCompiler.cpp
@@ -3793,8 +3793,42 @@ CacheIRCompiler::emitGuardGroupHasUnanal
 bool
 CacheIRCompiler::emitLoadObject()
 {
     Register reg = allocator.defineRegister(masm, reader.objOperandId());
     StubFieldOffset obj(reader.stubOffset(), StubField::Type::JSObject);
     emitLoadStubField(obj, reg);
     return true;
 }
+
+void
+js::jit::LoadTypedThingData(MacroAssembler& masm, TypedThingLayout layout, Register obj, Register result)
+{
+    switch (layout) {
+      case Layout_TypedArray:
+        masm.loadPtr(Address(obj, TypedArrayObject::dataOffset()), result);
+        break;
+      case Layout_OutlineTypedObject:
+        masm.loadPtr(Address(obj, OutlineTypedObject::offsetOfData()), result);
+        break;
+      case Layout_InlineTypedObject:
+        masm.computeEffectiveAddress(Address(obj, InlineTypedObject::offsetOfDataStart()), result);
+        break;
+      default:
+        MOZ_CRASH();
+    }
+}
+
+void
+js::jit::LoadTypedThingLength(MacroAssembler& masm, TypedThingLayout layout, Register obj, Register result)
+{
+    switch (layout) {
+      case Layout_TypedArray:
+        masm.unboxInt32(Address(obj, TypedArrayObject::lengthOffset()), result);
+        break;
+      case Layout_OutlineTypedObject:
+      case Layout_InlineTypedObject:
+        masm.loadTypedObjectLength(obj, result);
+        break;
+      default:
+        MOZ_CRASH();
+    }
+}
\ No newline at end of file
--- a/js/src/jit/CacheIRCompiler.h
+++ b/js/src/jit/CacheIRCompiler.h
@@ -897,12 +897,18 @@ class CacheIRStubInfo
     uintptr_t getStubRawWord(ICStub* stub, uint32_t field) const;
 
     void copyStubData(ICStub* src, ICStub* dest) const;
 };
 
 template <typename T>
 void TraceCacheIRStub(JSTracer* trc, T* stub, const CacheIRStubInfo* stubInfo);
 
+void
+LoadTypedThingData(MacroAssembler& masm, TypedThingLayout layout, Register obj, Register result);
+
+void
+LoadTypedThingLength(MacroAssembler& masm, TypedThingLayout layout, Register obj, Register result);
+
 } // namespace jit
 } // namespace js
 
 #endif /* jit_CacheIRCompiler_h */
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -2935,44 +2935,16 @@ CodeGenerator::visitBinaryCache(LBinaryC
         return;
       }
       default:
         MOZ_CRASH("Unsupported jsop in MBinaryCache");
     }
 }
 
 void
-CodeGenerator::visitBinarySharedStub(LBinarySharedStub* lir)
-{
-    JSOp jsop = JSOp(*lir->mirRaw()->toInstruction()->resumePoint()->pc());
-    switch (jsop) {
-      case JSOP_ADD:
-      case JSOP_SUB:
-      case JSOP_MUL:
-      case JSOP_DIV:
-      case JSOP_MOD:
-      case JSOP_POW:
-        emitSharedStub(ICStub::Kind::BinaryArith_Fallback, lir);
-        break;
-      case JSOP_LT:
-      case JSOP_LE:
-      case JSOP_GT:
-      case JSOP_GE:
-      case JSOP_EQ:
-      case JSOP_NE:
-      case JSOP_STRICTEQ:
-      case JSOP_STRICTNE:
-        emitSharedStub(ICStub::Kind::Compare_Fallback, lir);
-        break;
-      default:
-        MOZ_CRASH("Unsupported jsop in shared stubs.");
-    }
-}
-
-void
 CodeGenerator::visitUnaryCache(LUnaryCache* lir)
 {
     LiveRegisterSet liveRegs = lir->safepoint()->liveRegs();
     TypedOrValueRegister input = TypedOrValueRegister(ToValue(lir, LUnaryCache::Input));
     ValueOperand output = ToOutValue(lir);
 
     IonUnaryArithIC ic(liveRegs, input, output);
     addIC(lir, allocateIC(ic));
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -6109,19 +6109,18 @@ IonBuilder::compareTrySpecializedOnBasel
     return Ok();
 }
 
 AbortReasonOr<Ok>
 IonBuilder::compareTryBinaryStub(bool* emitted, MDefinition* left, MDefinition* right)
 {
     MOZ_ASSERT(*emitted == false);
 
-    // Try to emit a shared stub cache.
-
-    if (JitOptions.disableSharedStubs)
+    // Try to emit a CacheIR Stub.
+    if (JitOptions.disableCacheIR)
         return Ok();
 
     if (JSOp(*pc) == JSOP_CASE || IsCallPC(pc))
         return Ok();
 
     MBinaryCache* stub = MBinaryCache::New(alloc(), left, right);
     current->add(stub);
     current->push(stub);
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -2524,32 +2524,16 @@ LIRGenerator::visitBinaryCache(MBinaryCa
     LBinaryCache* lir = new(alloc()) LBinaryCache(useBox(lhs),
                                                   useBox(rhs),
                                                   tempFixed(FloatReg0),
                                                   tempFixed(FloatReg1));
     defineBox(lir, ins);
     assignSafepoint(lir, ins);
 }
 
-
-void
-LIRGenerator::visitBinarySharedStub(MBinarySharedStub* ins)
-{
-    MDefinition* lhs = ins->getOperand(0);
-    MDefinition* rhs = ins->getOperand(1);
-
-    MOZ_ASSERT(ins->type() == MIRType::Value);
-    MOZ_ASSERT(ins->type() == MIRType::Value);
-
-    LBinarySharedStub* lir = new(alloc()) LBinarySharedStub(useBoxFixedAtStart(lhs, R0),
-                                                            useBoxFixedAtStart(rhs, R1));
-    defineSharedStubReturn(lir, ins);
-    assignSafepoint(lir, ins);
-}
-
 void
 LIRGenerator::visitUnaryCache(MUnaryCache* ins)
 {
     MDefinition* input = ins->getOperand(0);
     MOZ_ASSERT(ins->type() == MIRType::Value);
 
     LUnaryCache* lir = new(alloc()) LUnaryCache(useBox(input));
     defineBox(lir, ins);
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -7107,32 +7107,16 @@ class MOsrReturnValue
     INSTRUCTION_HEADER(OsrReturnValue)
     TRIVIAL_NEW_WRAPPERS
 
     MOsrEntry* entry() {
         return getOperand(0)->toOsrEntry();
     }
 };
 
-class MBinarySharedStub
-  : public MBinaryInstruction,
-    public MixPolicy<BoxPolicy<0>, BoxPolicy<1> >::Data
-{
-  protected:
-    explicit MBinarySharedStub(MDefinition* left, MDefinition* right)
-      : MBinaryInstruction(classOpcode, left, right)
-    {
-        setResultType(MIRType::Value);
-    }
-
-  public:
-    INSTRUCTION_HEADER(BinarySharedStub)
-    TRIVIAL_NEW_WRAPPERS
-};
-
 class MBinaryCache
   : public MBinaryInstruction,
     public MixPolicy<BoxPolicy<0>, BoxPolicy<1> >::Data
 {
   protected:
     explicit MBinaryCache(MDefinition* left, MDefinition* right)
       : MBinaryInstruction(classOpcode, left, right)
     {
--- a/js/src/jit/SharedIC.cpp
+++ b/js/src/jit/SharedIC.cpp
@@ -633,68 +633,18 @@ ICStubCompiler::pushStubPayload(MacroAss
 
 void
 ICStubCompiler::PushStubPayload(MacroAssembler& masm, Register scratch)
 {
     pushStubPayload(masm, scratch);
     masm.adjustFrame(sizeof(intptr_t));
 }
 
-SharedStubInfo::SharedStubInfo(JSContext* cx, void* payload, ICEntry* icEntry)
-  : maybeFrame_(nullptr),
-    outerScript_(cx),
-    innerScript_(cx),
-    icEntry_(icEntry)
-{
-    if (payload) {
-        maybeFrame_ = (BaselineFrame*) payload;
-        outerScript_ = maybeFrame_->script();
-        innerScript_ = maybeFrame_->script();
-    } else {
-        IonICEntry* entry = (IonICEntry*) icEntry;
-        innerScript_ = entry->script();
-        // outerScript_ is initialized lazily.
-    }
-}
-
-HandleScript
-SharedStubInfo::outerScript(JSContext* cx)
-{
-    if (!outerScript_) {
-        js::jit::JitActivationIterator actIter(cx);
-        JSJitFrameIter it(actIter->asJit());
-        MOZ_ASSERT(it.isExitFrame());
-        ++it;
-        MOZ_ASSERT(it.isIonJS());
-        outerScript_ = it.script();
-        MOZ_ASSERT(!it.ionScript()->invalidated());
-    }
-    return outerScript_;
-}
-
 //
 void
-LoadTypedThingData(MacroAssembler& masm, TypedThingLayout layout, Register obj, Register result)
-{
-    switch (layout) {
-      case Layout_TypedArray:
-        masm.loadPtr(Address(obj, TypedArrayObject::dataOffset()), result);
-        break;
-      case Layout_OutlineTypedObject:
-        masm.loadPtr(Address(obj, OutlineTypedObject::offsetOfData()), result);
-        break;
-      case Layout_InlineTypedObject:
-        masm.computeEffectiveAddress(Address(obj, InlineTypedObject::offsetOfDataStart()), result);
-        break;
-      default:
-        MOZ_CRASH();
-    }
-}
-
-void
 BaselineScript::noteAccessedGetter(uint32_t pcOffset)
 {
     ICEntry& entry = icEntryFromPCOffset(pcOffset);
     ICFallbackStub* stub = entry.fallbackStub();
 
     if (stub->isGetProp_Fallback())
         stub->toGetProp_Fallback()->noteAccessedGetter();
 }
--- a/js/src/jit/SharedIC.h
+++ b/js/src/jit/SharedIC.h
@@ -7,17 +7,16 @@
 #ifndef jit_SharedIC_h
 #define jit_SharedIC_h
 
 #include "gc/GC.h"
 #include "jit/BaselineICList.h"
 #include "jit/BaselineJIT.h"
 #include "jit/ICState.h"
 #include "jit/MacroAssembler.h"
-#include "jit/SharedICList.h"
 #include "jit/SharedICRegisters.h"
 #include "vm/JSContext.h"
 #include "vm/Realm.h"
 #include "vm/ReceiverGuard.h"
 #include "vm/TypedArrayObject.h"
 
 namespace js {
 namespace jit {
@@ -190,19 +189,19 @@ namespace jit {
 //     +-----------+     +-----------+     +-----------+
 //     | Type 1.1  |---->| Type 1.2  |---->|   FB 1    |
 //     +-----------+     +-----------+     +-----------+
 //
 
 class ICStub;
 class ICFallbackStub;
 
+
 #define FORWARD_DECLARE_STUBS(kindName) class IC##kindName;
     IC_BASELINE_STUB_KIND_LIST(FORWARD_DECLARE_STUBS)
-    IC_SHARED_STUB_KIND_LIST(FORWARD_DECLARE_STUBS)
 #undef FORWARD_DECLARE_STUBS
 
 #ifdef JS_JITSPEW
 void FallbackICSpew(JSContext* cx, ICFallbackStub* stub, const char* fmt, ...)
     MOZ_FORMAT_PRINTF(3, 4);
 void TypeFallbackICSpew(JSContext* cx, ICTypeMonitor_Fallback* stub, const char* fmt, ...)
     MOZ_FORMAT_PRINTF(3, 4);
 #else
@@ -494,33 +493,31 @@ class ICStub
 {
     friend class ICFallbackStub;
 
   public:
     enum Kind {
         INVALID = 0,
 #define DEF_ENUM_KIND(kindName) kindName,
         IC_BASELINE_STUB_KIND_LIST(DEF_ENUM_KIND)
-        IC_SHARED_STUB_KIND_LIST(DEF_ENUM_KIND)
 #undef DEF_ENUM_KIND
         LIMIT
     };
 
     static bool IsValidKind(Kind k) {
         return (k > INVALID) && (k < LIMIT);
     }
     static bool IsCacheIRKind(Kind k) {
         return k == CacheIR_Regular || k == CacheIR_Monitored || k == CacheIR_Updated;
     }
 
     static const char* KindString(Kind k) {
         switch(k) {
 #define DEF_KIND_STR(kindName) case kindName: return #kindName;
             IC_BASELINE_STUB_KIND_LIST(DEF_KIND_STR)
-            IC_SHARED_STUB_KIND_LIST(DEF_KIND_STR)
 #undef DEF_KIND_STR
           default:
             MOZ_CRASH("Invalid kind.");
         }
     }
 
     enum Trait {
         Regular             = 0x0,
@@ -654,17 +651,16 @@ class ICStub
         MOZ_ASSERT(is##kindName()); \
         return reinterpret_cast<const IC##kindName*>(this); \
     } \
     inline IC##kindName* to##kindName() { \
         MOZ_ASSERT(is##kindName()); \
         return reinterpret_cast<IC##kindName*>(this); \
     }
     IC_BASELINE_STUB_KIND_LIST(KIND_METHODS)
-    IC_SHARED_STUB_KIND_LIST(KIND_METHODS)
 #undef KIND_METHODS
 
     inline ICStub* next() const {
         return next_;
     }
 
     inline bool hasNext() const {
         return next_ != nullptr;
@@ -1077,21 +1073,16 @@ class ICStubCompiler
 
     // A stub frame is used when a stub wants to call into the VM without
     // performing a tail call. This is required for the return address
     // to pc mapping to work.
     void enterStubFrame(MacroAssembler& masm, Register scratch);
     void assumeStubFrame();
     void leaveStubFrame(MacroAssembler& masm, bool calledIntoIon = false);
 
-    // Some stubs need to emit Gecko Profiler updates.  This emits the guarding
-    // jitcode for those stubs.  If profiling is not enabled, jumps to the
-    // given label.
-    void guardProfilingEnabled(MacroAssembler& masm, Register scratch, Label* skip);
-
   public:
     static inline AllocatableGeneralRegisterSet availableGeneralRegs(size_t numInputs) {
         AllocatableGeneralRegisterSet regs(GeneralRegisterSet::All());
 #if defined(JS_CODEGEN_ARM)
         MOZ_ASSERT(!regs.has(BaselineStackReg));
         MOZ_ASSERT(!regs.has(ICTailCallReg));
         regs.take(BaselineSecondScratchReg);
 #elif defined(JS_CODEGEN_MIPS32) || defined(JS_CODEGEN_MIPS64)
@@ -1146,66 +1137,16 @@ class ICStubCompiler
         }
         return outerScript->zone()->jitZone()->optimizedStubSpace();
     }
     ICStubSpace* getStubSpace(JSScript* outerScript) {
         return StubSpaceForStub(ICStub::NonCacheIRStubMakesGCCalls(kind), outerScript, engine_);
     }
 };
 
-class SharedStubInfo
-{
-    BaselineFrame* maybeFrame_;
-    RootedScript outerScript_;
-    RootedScript innerScript_;
-    ICEntry* icEntry_;
-
-  public:
-    SharedStubInfo(JSContext* cx, void* payload, ICEntry* entry);
-
-    ICStubCompiler::Engine engine() const {
-        return maybeFrame_
-               ? ICStubCompiler::Engine::Baseline
-               : ICStubCompiler::Engine::IonSharedIC;
-    }
-
-    HandleScript script() const {
-        MOZ_ASSERT(innerScript_);
-        return innerScript_;
-    }
-
-    HandleScript innerScript() const {
-        MOZ_ASSERT(innerScript_);
-        return innerScript_;
-    }
-
-    HandleScript outerScript(JSContext* cx);
-
-    jsbytecode* pc() const {
-        return icEntry()->pc(innerScript());
-    }
-
-    uint32_t pcOffset() const {
-        return script()->pcToOffset(pc());
-    }
-
-    BaselineFrame* frame() const {
-        MOZ_ASSERT(maybeFrame_);
-        return maybeFrame_;
-    }
-
-    BaselineFrame* maybeFrame() const {
-        return maybeFrame_;
-    }
-
-    ICEntry* icEntry() const {
-        return icEntry_;
-    }
-};
-
 // Monitored fallback stubs - as the name implies.
 class ICMonitoredFallbackStub : public ICFallbackStub
 {
   protected:
     // Pointer to the fallback monitor stub. Created lazily by
     // getFallbackMonitorStub if needed.
     ICTypeMonitor_Fallback* fallbackMonitorStub_;
 
@@ -1228,36 +1169,16 @@ class ICMonitoredFallbackStub : public I
         return fallbackMonitorStub_;
     }
 
     static inline size_t offsetOfFallbackMonitorStub() {
         return offsetof(ICMonitoredFallbackStub, fallbackMonitorStub_);
     }
 };
 
-
-// Base class for stub compilers that can generate multiple stubcodes.
-// These compilers need access to the JSOp they are compiling for.
-class ICMultiStubCompiler : public ICStubCompiler
-{
-  protected:
-    JSOp op;
-
-    // Stub keys for multi-stub kinds are composed of both the kind
-    // and the op they are compiled for.
-    virtual int32_t getKey() const override {
-        return static_cast<int32_t>(engine_) |
-              (static_cast<int32_t>(kind) << 1) |
-              (static_cast<int32_t>(op) << 17);
-    }
-
-    ICMultiStubCompiler(JSContext* cx, ICStub::Kind kind, JSOp op, Engine engine)
-      : ICStubCompiler(cx, kind, engine), op(op) {}
-};
-
 // TypeCheckPrimitiveSetStub
 //   Base class for IC stubs (TypeUpdate or TypeMonitor) that check that a given
 //   value's type falls within a set of primitive types.
 
 class TypeCheckPrimitiveSetStub : public ICStub
 {
     friend class ICStubSpace;
   protected:
@@ -1680,31 +1601,16 @@ class ICCompare_Fallback : public ICFall
           : ICStubCompiler(cx, ICStub::Compare_Fallback, engine) {}
 
         ICStub* getStub(ICStubSpace* space) override {
             return newStub<ICCompare_Fallback>(space, getStubCode());
         }
     };
 };
 
-// Enum for stubs handling a combination of typed arrays and typed objects.
-enum TypedThingLayout {
-    Layout_TypedArray,
-    Layout_OutlineTypedObject,
-    Layout_InlineTypedObject
-};
-
-void
-StripPreliminaryObjectStubs(JSContext* cx, ICFallbackStub* stub);
-
-void
-LoadTypedThingData(MacroAssembler& masm, TypedThingLayout layout, Register obj, Register result);
-
-void
-LoadTypedThingLength(MacroAssembler& masm, TypedThingLayout layout, Register obj, Register result);
 
 class ICGetProp_Fallback : public ICMonitoredFallbackStub
 {
     friend class ICStubSpace;
 
     explicit ICGetProp_Fallback(JitCode* stubCode)
       : ICMonitoredFallbackStub(ICStub::GetProp_Fallback, stubCode)
     { }
@@ -1747,40 +1653,12 @@ class ICGetProp_Fallback : public ICMoni
         { }
 
         ICStub* getStub(ICStubSpace* space) override {
             return newStub<ICGetProp_Fallback>(space, getStubCode());
         }
     };
 };
 
-static inline uint32_t
-SimpleTypeDescrKey(SimpleTypeDescr* descr)
-{
-    if (descr->is<ScalarTypeDescr>())
-        return uint32_t(descr->as<ScalarTypeDescr>().type()) << 1;
-    return (uint32_t(descr->as<ReferenceTypeDescr>().type()) << 1) | 1;
-}
-
-inline bool
-SimpleTypeDescrKeyIsScalar(uint32_t key)
-{
-    return !(key & 1);
-}
-
-inline ScalarTypeDescr::Type
-ScalarTypeFromSimpleTypeDescrKey(uint32_t key)
-{
-    MOZ_ASSERT(SimpleTypeDescrKeyIsScalar(key));
-    return ScalarTypeDescr::Type(key >> 1);
-}
-
-inline ReferenceType
-ReferenceTypeFromSimpleTypeDescrKey(uint32_t key)
-{
-    MOZ_ASSERT(!SimpleTypeDescrKeyIsScalar(key));
-    return ReferenceType(key >> 1);
-}
-
 } // namespace jit
 } // namespace js
 
 #endif /* jit_SharedIC_h */
deleted file mode 100644
--- a/js/src/jit/SharedICList.h
+++ /dev/null
@@ -1,29 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sts=4 et sw=4 tw=99:
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef jit_SharedICList_h
-#define jit_SharedICList_h
-
-namespace js {
-namespace jit {
-
-// List of IC stub kinds that can run in Baseline and in IonMonkey
-#define IC_SHARED_STUB_KIND_LIST(_)              \
-    _(BinaryArith_Fallback)                      \
-                                                 \
-    _(Compare_Fallback)                          \
-                                                 \
-    _(GetProp_Fallback)                          \
-                                                 \
-    _(CacheIR_Regular)                           \
-    _(CacheIR_Monitored)                         \
-    _(CacheIR_Updated)                           \
-                                                 \
-
-} // namespace jit
-} // namespace js
-
-#endif /* jit_SharedICList_h */
--- a/js/src/jit/shared/LIR-shared.h
+++ b/js/src/jit/shared/LIR-shared.h
@@ -4791,36 +4791,16 @@ class LStringReplace: public LCallInstru
     const LAllocation* pattern() {
         return getOperand(1);
     }
     const LAllocation* replacement() {
         return getOperand(2);
     }
 };
 
-class LBinarySharedStub : public LCallInstructionHelper<BOX_PIECES, 2 * BOX_PIECES, 0>
-{
-  public:
-    LIR_HEADER(BinarySharedStub)
-
-    LBinarySharedStub(const LBoxAllocation& lhs, const LBoxAllocation& rhs)
-      : LCallInstructionHelper(classOpcode)
-    {
-        setBoxOperand(LhsInput, lhs);
-        setBoxOperand(RhsInput, rhs);
-    }
-
-    const MBinarySharedStub* mir() const {
-        return mir_->toBinarySharedStub();
-    }
-
-    static const size_t LhsInput = 0;
-    static const size_t RhsInput = BOX_PIECES;
-};
-
 class LBinaryCache : public LInstructionHelper<BOX_PIECES, 2 * BOX_PIECES, 2>
 {
   public:
     LIR_HEADER(BinaryCache)
 
     // Takes two temps: these are intendend to be FloatReg0 and FloatReg1
     // To allow the actual cache code to safely clobber those values without
     // save and restore.
--- a/js/src/jit/shared/Lowering-shared-inl.h
+++ b/js/src/jit/shared/Lowering-shared-inl.h
@@ -245,17 +245,17 @@ LIRGeneratorShared::defineInt64(LInstruc
     add(lir);
 }
 
 void
 LIRGeneratorShared::defineSharedStubReturn(LInstruction* lir, MDefinition* mir)
 {
     lir->setMir(mir);
 
-    MOZ_ASSERT(lir->isBinarySharedStub() || lir->isNullarySharedStub());
+    MOZ_ASSERT(lir->isNullarySharedStub());
     MOZ_ASSERT(mir->type() == MIRType::Value);
 
     uint32_t vreg = getVirtualRegister();
 
 #if defined(JS_NUNBOX32)
     lir->setDef(TYPE_INDEX, LDefinition(vreg + VREG_TYPE_OFFSET, LDefinition::TYPE,
                                         LGeneralReg(JSReturnReg_Type)));
     lir->setDef(PAYLOAD_INDEX, LDefinition(vreg + VREG_DATA_OFFSET, LDefinition::PAYLOAD,