Bug 1542740: Add TRY_ATTACH macro and new versions of TryAttach templates r=mgaudet
authorIain Ireland <iireland@mozilla.com>
Fri, 26 Apr 2019 14:27:53 +0000
changeset 530322 1140aa6cfb408359845ca5a14db189c7597941aa
parent 530321 da6e65869c99409518d0f2ccd2a2dc174aac1450
child 530323 f3c7978228c0c13793704a6e1b9bab1387c003eb
push id11265
push userffxbld-merge
push dateMon, 13 May 2019 10:53:39 +0000
treeherdermozilla-beta@77e0fe8dbdd3 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmgaudet
bugs1542740
milestone68.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1542740: Add TRY_ATTACH macro and new versions of TryAttach templates r=mgaudet This patch lays the groundwork for the stack. To make it possible to switch everything over incrementally, I renamed the existing TryAttachStub/TryAttachIonStub templates, and added a new version. The old version gets deleted later in the stack when all the consumers have been fixed up. Differential Revision: https://phabricator.services.mozilla.com/D27297
js/src/jit/BaselineIC.cpp
js/src/jit/CacheIR.cpp
js/src/jit/CacheIR.h
js/src/jit/IonIC.cpp
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -720,19 +720,19 @@ void ICStub::trace(JSTracer* trc) {
     default:
       break;
   }
 }
 
 // This helper handles ICState updates/transitions while attaching CacheIR
 // stubs.
 template <typename IRGenerator, typename... Args>
-static void TryAttachStub(const char* name, JSContext* cx, BaselineFrame* frame,
-                          ICFallbackStub* stub, BaselineCacheIRStubKind kind,
-                          Args&&... args) {
+static void TryAttachStubOld(const char* name, JSContext* cx,
+                             BaselineFrame* frame, ICFallbackStub* stub,
+                             BaselineCacheIRStubKind kind, Args&&... args) {
   if (stub->state().maybeTransition()) {
     stub->discardStubs(cx);
   }
 
   if (stub->state().canAttachStub()) {
     RootedScript script(cx, frame->script());
     jsbytecode* pc = stub->icEntry()->pc(script);
 
@@ -748,16 +748,55 @@ static void TryAttachStub(const char* na
       }
     }
     if (!attached) {
       stub->state().trackNotAttached();
     }
   }
 }
 
+// This helper handles ICState updates/transitions while attaching CacheIR
+// stubs.
+template <typename IRGenerator, typename... Args>
+static void TryAttachStub(const char* name, JSContext* cx, BaselineFrame* frame,
+                          ICFallbackStub* stub, BaselineCacheIRStubKind kind,
+                          Args&&... args) {
+  if (stub->state().maybeTransition()) {
+    stub->discardStubs(cx);
+  }
+
+  if (stub->state().canAttachStub()) {
+    RootedScript script(cx, frame->script());
+    jsbytecode* pc = stub->icEntry()->pc(script);
+
+    bool attached = false;
+    IRGenerator gen(cx, script, pc, stub->state().mode(),
+                    std::forward<Args>(args)...);
+    switch (gen.tryAttachStub()) {
+      case AttachDecision::Attach: {
+        ICStub* newStub =
+            AttachBaselineCacheIRStub(cx, gen.writerRef(), gen.cacheKind(),
+                                      kind, script, stub, &attached);
+        if (newStub) {
+          JitSpew(JitSpew_BaselineIC, "  Attached %s CacheIR stub", name);
+        }
+      } break;
+      case AttachDecision::NoAction:
+        break;
+      case AttachDecision::TemporarilyUnoptimizable:
+      case AttachDecision::Deferred:
+        MOZ_ASSERT_UNREACHABLE("Not expected in generic TryAttachStub");
+        break;
+    }
+    if (!attached) {
+      stub->state().trackNotAttached();
+    }
+  }
+}
+
 //
 // WarmUpCounter_Fallback
 //
 
 /* clang-format off */
 // The following data is kept in a temporary heap-allocated buffer, stored in
 // JitRuntime (high memory addresses at top, low at bottom):
 //
@@ -1979,18 +2018,18 @@ bool ICTypeUpdate_AnyValue::Compiler::ge
 bool DoToBoolFallback(JSContext* cx, BaselineFrame* frame,
                       ICToBool_Fallback* stub, HandleValue arg,
                       MutableHandleValue ret) {
   stub->incrementEnteredCount();
   FallbackICSpew(cx, stub, "ToBool");
 
   MOZ_ASSERT(!arg.isBoolean());
 
-  TryAttachStub<ToBoolIRGenerator>("ToBool", cx, frame, stub,
-                                   BaselineCacheIRStubKind::Regular, arg);
+  TryAttachStubOld<ToBoolIRGenerator>("ToBool", cx, frame, stub,
+                                      BaselineCacheIRStubKind::Regular, arg);
 
   bool cond = ToBoolean(arg);
   ret.setBoolean(cond);
 
   return true;
 }
 
 bool FallbackICCodeCompiler::emit_ToBool() {
@@ -2558,19 +2597,19 @@ bool DoInFallback(JSContext* cx, Baselin
 
   FallbackICSpew(cx, stub, "In");
 
   if (!objValue.isObject()) {
     ReportInNotObjectError(cx, key, -2, objValue, -1);
     return false;
   }
 
-  TryAttachStub<HasPropIRGenerator>("In", cx, frame, stub,
-                                    BaselineCacheIRStubKind::Regular,
-                                    CacheKind::In, key, objValue);
+  TryAttachStubOld<HasPropIRGenerator>("In", cx, frame, stub,
+                                       BaselineCacheIRStubKind::Regular,
+                                       CacheKind::In, key, objValue);
 
   RootedObject obj(cx, &objValue.toObject());
   bool cond = false;
   if (!OperatorIn(cx, key, obj, &cond)) {
     return false;
   }
   res.setBoolean(cond);
 
@@ -2601,19 +2640,19 @@ bool FallbackICCodeCompiler::emit_In() {
 
 bool DoHasOwnFallback(JSContext* cx, BaselineFrame* frame,
                       ICHasOwn_Fallback* stub, HandleValue keyValue,
                       HandleValue objValue, MutableHandleValue res) {
   stub->incrementEnteredCount();
 
   FallbackICSpew(cx, stub, "HasOwn");
 
-  TryAttachStub<HasPropIRGenerator>("HasOwn", cx, frame, stub,
-                                    BaselineCacheIRStubKind::Regular,
-                                    CacheKind::HasOwn, keyValue, objValue);
+  TryAttachStubOld<HasPropIRGenerator>("HasOwn", cx, frame, stub,
+                                       BaselineCacheIRStubKind::Regular,
+                                       CacheKind::HasOwn, keyValue, objValue);
 
   bool found;
   if (!HasOwnProperty(cx, objValue, keyValue, &found)) {
     return false;
   }
 
   res.setBoolean(found);
   return true;
@@ -2650,19 +2689,19 @@ bool DoGetNameFallback(JSContext* cx, Ba
   jsbytecode* pc = stub->icEntry()->pc(script);
   mozilla::DebugOnly<JSOp> op = JSOp(*pc);
   FallbackICSpew(cx, stub, "GetName(%s)", CodeName[JSOp(*pc)]);
 
   MOZ_ASSERT(op == JSOP_GETNAME || op == JSOP_GETGNAME);
 
   RootedPropertyName name(cx, script->getName(pc));
 
-  TryAttachStub<GetNameIRGenerator>("GetName", cx, frame, stub,
-                                    BaselineCacheIRStubKind::Monitored,
-                                    envChain, name);
+  TryAttachStubOld<GetNameIRGenerator>("GetName", cx, frame, stub,
+                                       BaselineCacheIRStubKind::Monitored,
+                                       envChain, name);
 
   static_assert(JSOP_GETGNAME_LENGTH == JSOP_GETNAME_LENGTH,
                 "Otherwise our check for JSOP_TYPEOF isn't ok");
   if (JSOp(pc[JSOP_GETGNAME_LENGTH]) == JSOP_TYPEOF) {
     if (!GetEnvironmentName<GetNameMode::TypeOf>(cx, envChain, name, res)) {
       return false;
     }
   } else {
@@ -2708,19 +2747,19 @@ bool DoBindNameFallback(JSContext* cx, B
   jsbytecode* pc = stub->icEntry()->pc(frame->script());
   mozilla::DebugOnly<JSOp> op = JSOp(*pc);
   FallbackICSpew(cx, stub, "BindName(%s)", CodeName[JSOp(*pc)]);
 
   MOZ_ASSERT(op == JSOP_BINDNAME || op == JSOP_BINDGNAME);
 
   RootedPropertyName name(cx, frame->script()->getName(pc));
 
-  TryAttachStub<BindNameIRGenerator>("BindName", cx, frame, stub,
-                                     BaselineCacheIRStubKind::Regular, envChain,
-                                     name);
+  TryAttachStubOld<BindNameIRGenerator>("BindName", cx, frame, stub,
+                                        BaselineCacheIRStubKind::Regular,
+                                        envChain, name);
 
   RootedObject scope(cx);
   if (!LookupNameUnqualified(cx, name, envChain, &scope)) {
     return false;
   }
 
   res.setObject(*scope);
   return true;
@@ -2761,18 +2800,18 @@ bool DoGetIntrinsicFallback(JSContext* c
   }
 
   // An intrinsic operation will always produce the same result, so only
   // needs to be monitored once. Attach a stub to load the resulting constant
   // directly.
 
   TypeScript::Monitor(cx, script, pc, res);
 
-  TryAttachStub<GetIntrinsicIRGenerator>("GetIntrinsic", cx, frame, stub,
-                                         BaselineCacheIRStubKind::Regular, res);
+  TryAttachStubOld<GetIntrinsicIRGenerator>(
+      "GetIntrinsic", cx, frame, stub, BaselineCacheIRStubKind::Regular, res);
 
   return true;
 }
 
 bool FallbackICCodeCompiler::emit_GetIntrinsic() {
   EmitRestoreTailCallReg(masm);
 
   masm.push(ICStubReg);
@@ -5440,17 +5479,17 @@ bool ICCall_ScriptedFunCall::Compiler::g
 //
 
 bool DoGetIteratorFallback(JSContext* cx, BaselineFrame* frame,
                            ICGetIterator_Fallback* stub, HandleValue value,
                            MutableHandleValue res) {
   stub->incrementEnteredCount();
   FallbackICSpew(cx, stub, "GetIterator");
 
-  TryAttachStub<GetIteratorIRGenerator>(
+  TryAttachStubOld<GetIteratorIRGenerator>(
       "GetIterator", cx, frame, stub, BaselineCacheIRStubKind::Regular, value);
 
   JSObject* iterobj = ValueToIterator(cx, value);
   if (!iterobj) {
     return false;
   }
 
   res.setObject(*iterobj);
@@ -5504,19 +5543,19 @@ bool DoInstanceOfFallback(JSContext* cx,
     }
     return true;
   }
 
   // For functions, keep track of the |prototype| property in type information,
   // for use during Ion compilation.
   EnsureTrackPropertyTypes(cx, obj, NameToId(cx->names().prototype));
 
-  TryAttachStub<InstanceOfIRGenerator>("InstanceOf", cx, frame, stub,
-                                       BaselineCacheIRStubKind::Regular, lhs,
-                                       obj);
+  TryAttachStubOld<InstanceOfIRGenerator>("InstanceOf", cx, frame, stub,
+                                          BaselineCacheIRStubKind::Regular, lhs,
+                                          obj);
   return true;
 }
 
 bool FallbackICCodeCompiler::emit_InstanceOf() {
   EmitRestoreTailCallReg(masm);
 
   // Sync stack for the decompiler.
   masm.pushValue(R0);
@@ -5537,18 +5576,18 @@ bool FallbackICCodeCompiler::emit_Instan
 //
 
 bool DoTypeOfFallback(JSContext* cx, BaselineFrame* frame,
                       ICTypeOf_Fallback* stub, HandleValue val,
                       MutableHandleValue res) {
   stub->incrementEnteredCount();
   FallbackICSpew(cx, stub, "TypeOf");
 
-  TryAttachStub<TypeOfIRGenerator>("TypeOf", cx, frame, stub,
-                                   BaselineCacheIRStubKind::Regular, val);
+  TryAttachStubOld<TypeOfIRGenerator>("TypeOf", cx, frame, stub,
+                                      BaselineCacheIRStubKind::Regular, val);
 
   JSType type = js::TypeOfValue(val);
   RootedString string(cx, TypeName(type, cx->names()));
   res.setString(string);
   return true;
 }
 
 bool FallbackICCodeCompiler::emit_TypeOf() {
@@ -5696,19 +5735,19 @@ bool DoUnaryArithFallback(JSContext* cx,
     default:
       MOZ_CRASH("Unexpected op");
   }
 
   if (res.isDouble()) {
     stub->setSawDoubleResult();
   }
 
-  TryAttachStub<UnaryArithIRGenerator>("UniaryArith", cx, frame, stub,
-                                       BaselineCacheIRStubKind::Regular, op,
-                                       val, res);
+  TryAttachStubOld<UnaryArithIRGenerator>("UniaryArith", cx, frame, stub,
+                                          BaselineCacheIRStubKind::Regular, op,
+                                          val, res);
   return true;
 }
 
 bool FallbackICCodeCompiler::emit_UnaryArith() {
   MOZ_ASSERT(R0 == JSReturnOperand);
 
   // Restore the tail call register.
   EmitRestoreTailCallReg(masm);
@@ -5820,19 +5859,19 @@ bool DoBinaryArithFallback(JSContext* cx
     default:
       MOZ_CRASH("Unhandled baseline arith op");
   }
 
   if (ret.isDouble()) {
     stub->setSawDoubleResult();
   }
 
-  TryAttachStub<BinaryArithIRGenerator>("BinaryArith", cx, frame, stub,
-                                        BaselineCacheIRStubKind::Regular, op,
-                                        lhs, rhs, ret);
+  TryAttachStubOld<BinaryArithIRGenerator>("BinaryArith", cx, frame, stub,
+                                           BaselineCacheIRStubKind::Regular, op,
+                                           lhs, rhs, ret);
   return true;
 }
 
 bool FallbackICCodeCompiler::emit_BinaryArith() {
   MOZ_ASSERT(R0 == JSReturnOperand);
 
   // Restore the tail call register.
   EmitRestoreTailCallReg(masm);
@@ -5917,19 +5956,19 @@ bool DoCompareFallback(JSContext* cx, Ba
       break;
     default:
       MOZ_ASSERT_UNREACHABLE("Unhandled baseline compare op");
       return false;
   }
 
   ret.setBoolean(out);
 
-  TryAttachStub<CompareIRGenerator>("Compare", cx, frame, stub,
-                                    BaselineCacheIRStubKind::Regular, op, lhs,
-                                    rhs);
+  TryAttachStubOld<CompareIRGenerator>("Compare", cx, frame, stub,
+                                       BaselineCacheIRStubKind::Regular, op,
+                                       lhs, rhs);
   return true;
 }
 
 bool FallbackICCodeCompiler::emit_Compare() {
   MOZ_ASSERT(R0 == JSReturnOperand);
 
   // Restore the tail call register.
   EmitRestoreTailCallReg(masm);
@@ -6023,19 +6062,19 @@ bool DoNewObjectFallback(JSContext* cx, 
 
     if (obj && !obj->isSingleton() &&
         !obj->group()->maybePreliminaryObjectsDontCheckGeneration()) {
       templateObject = NewObjectOperation(cx, script, pc, TenuredObject);
       if (!templateObject) {
         return false;
       }
 
-      TryAttachStub<NewObjectIRGenerator>("NewObject", cx, frame, stub,
-                                          BaselineCacheIRStubKind::Regular,
-                                          JSOp(*pc), templateObject);
+      TryAttachStubOld<NewObjectIRGenerator>("NewObject", cx, frame, stub,
+                                             BaselineCacheIRStubKind::Regular,
+                                             JSOp(*pc), templateObject);
 
       stub->setTemplateObject(templateObject);
     }
   }
 
   if (!obj) {
     return false;
   }
--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@@ -5371,20 +5371,17 @@ AttachDecision CallIRGenerator::tryAttac
   CallFlags flags(isConstructing, isSpread, isSameRealm);
 
   if (isConstructing && !calleeFunc->isConstructor()) {
     return AttachDecision::NoAction;
   }
 
   // Check for specific native-function optimizations.
   if (isSpecialized) {
-    AttachDecision decision = tryAttachSpecialCaseCallNative(calleeFunc);
-    if (decision != AttachDecision::NoAction) {
-      return decision;
-    }
+    TRY_ATTACH(tryAttachSpecialCaseCallNative(calleeFunc));
   }
   if (JitOptions.disableCacheIRCalls) {
     return AttachDecision::NoAction;
   }
 
   RootedObject templateObj(cx_);
   if (isConstructing && isSpecialized &&
       !getTemplateObjectForNative(calleeFunc, &templateObj)) {
--- a/js/src/jit/CacheIR.h
+++ b/js/src/jit/CacheIR.h
@@ -506,22 +506,47 @@ class CallFlags {
   static const uint8_t IsConstructing = 1 << 5;
   static const uint8_t IsSameRealm = 1 << 6;
 
   friend class CacheIRReader;
   friend class CacheIRWriter;
 };
 
 enum class AttachDecision {
+  // We cannot attach a stub.
   NoAction,
+
+  // We can attach a stub.
   Attach,
+
+  // We cannot currently attach a stub, but we expect to be able to do so in the
+  // future. In this case, we do not call trackNotAttached().
   TemporarilyUnoptimizable,
+
+  // We want to attach a stub, but the result of the operation is
+  // needed to generate that stub. For example, AddSlot needs to know
+  // the resulting shape. Note: the attached stub will inspect the
+  // inputs to the operation, so most input checks should be done
+  // before the actual operation, with only minimal checks remaining
+  // for the deferred portion. This prevents arbitrary scripted code
+  // run by the operation from interfering with the conditions being
+  // checked.
   Deferred
 };
 
+// If the input expression evaluates to an AttachDecision other than NoAction,
+// return that AttachDecision. If it is NoAction, do nothing.
+#define TRY_ATTACH(expr)                      \
+  do {                                        \
+    AttachDecision result = expr;             \
+    if (result != AttachDecision::NoAction) { \
+      return result;                          \
+    }                                         \
+  } while (0)
+
 // Set of arguments supported by GetIndexOfArgument.
 // Support for Arg2 and up can be added easily, but is currently unneeded.
 enum class ArgumentKind : uint8_t { Callee, This, NewTarget, Arg0, Arg1 };
 
 // This function calculates the index of an argument based on the call flags.
 // addArgc is an out-parameter, indicating whether the value of argc should
 // be added to the return value to find the actual index.
 inline int32_t GetIndexOfArgument(ArgumentKind kind, CallFlags flags,
--- a/js/src/jit/IonIC.cpp
+++ b/js/src/jit/IonIC.cpp
@@ -110,16 +110,74 @@ void IonIC::trace(JSTracer* trc) {
     TraceCacheIRStub(trc, stub, stub->stubInfo());
 
     nextCodeRaw = stub->nextCodeRaw();
   }
 
   MOZ_ASSERT(nextCodeRaw == fallbackLabel_.raw());
 }
 
+// This helper handles ICState updates/transitions while attaching CacheIR
+// stubs.
+template <typename IRGenerator, typename IC, typename... Args>
+static void TryAttachIonStubOld(JSContext* cx, IC* ic, IonScript* ionScript,
+                                Args&&... args) {
+  if (ic->state().maybeTransition()) {
+    ic->discardStubs(cx->zone());
+  }
+
+  if (ic->state().canAttachStub()) {
+    RootedScript script(cx, ic->script());
+    bool attached = false;
+    IRGenerator gen(cx, script, ic->pc(), ic->state().mode(),
+                    std::forward<Args>(args)...);
+    if (gen.tryAttachStub()) {
+      ic->attachCacheIRStub(cx, gen.writerRef(), gen.cacheKind(), ionScript,
+                            &attached);
+    }
+    if (!attached) {
+      ic->state().trackNotAttached();
+    }
+  }
+}
+
+// This helper handles ICState updates/transitions while attaching CacheIR
+// stubs.
+template <typename IRGenerator, typename IC, typename... Args>
+static void TryAttachIonStub(JSContext* cx, IC* ic, IonScript* ionScript,
+                             Args&&... args) {
+  if (ic->state().maybeTransition()) {
+    ic->discardStubs(cx->zone());
+  }
+
+  if (ic->state().canAttachStub()) {
+    RootedScript script(cx, ic->script());
+    bool attached = false;
+    IRGenerator gen(cx, script, ic->pc(), ic->state().mode(),
+                    std::forward<Args>(args)...);
+    switch (gen.tryAttachStub()) {
+      case AttachDecision::Attach:
+        ic->attachCacheIRStub(cx, gen.writerRef(), gen.cacheKind(), ionScript,
+                              &attached);
+        break;
+      case AttachDecision::NoAction:
+        break;
+      case AttachDecision::TemporarilyUnoptimizable:
+        attached = true;
+        break;
+      case AttachDecision::Deferred:
+        MOZ_ASSERT_UNREACHABLE("Not expected in generic TryAttachIonStub");
+        break;
+    }
+    if (!attached) {
+      ic->state().trackNotAttached();
+    }
+  }
+}
+
 /* static */
 bool IonGetPropertyIC::update(JSContext* cx, HandleScript outerScript,
                               IonGetPropertyIC* ic, HandleValue val,
                               HandleValue idVal, MutableHandleValue res) {
   // Override the return value if we are invalidated (bug 728188).
   IonScript* ionScript = outerScript->ionScript();
   AutoDetectInvalidation adi(cx, res, ionScript);
 
@@ -347,50 +405,26 @@ bool IonSetPropertyIC::update(JSContext*
     if (!attached && !isTemporarilyUnoptimizable) {
       ic->state().trackNotAttached();
     }
   }
 
   return true;
 }
 
-// This helper handles ICState updates/transitions while attaching CacheIR
-// stubs.
-template <typename IRGenerator, typename IC, typename... Args>
-static void TryAttachIonStub(JSContext* cx, IC* ic, IonScript* ionScript,
-                             Args&&... args) {
-  if (ic->state().maybeTransition()) {
-    ic->discardStubs(cx->zone());
-  }
-
-  if (ic->state().canAttachStub()) {
-    RootedScript script(cx, ic->script());
-    bool attached = false;
-    IRGenerator gen(cx, script, ic->pc(), ic->state().mode(),
-                    std::forward<Args>(args)...);
-    if (gen.tryAttachStub()) {
-      ic->attachCacheIRStub(cx, gen.writerRef(), gen.cacheKind(), ionScript,
-                            &attached);
-    }
-    if (!attached) {
-      ic->state().trackNotAttached();
-    }
-  }
-}
-
 /* static */
 bool IonGetNameIC::update(JSContext* cx, HandleScript outerScript,
                           IonGetNameIC* ic, HandleObject envChain,
                           MutableHandleValue res) {
   IonScript* ionScript = outerScript->ionScript();
   jsbytecode* pc = ic->pc();
   RootedPropertyName name(cx, ic->script()->getName(pc));
 
-  TryAttachIonStub<GetNameIRGenerator, IonGetNameIC>(cx, ic, ionScript,
-                                                     envChain, name);
+  TryAttachIonStubOld<GetNameIRGenerator, IonGetNameIC>(cx, ic, ionScript,
+                                                        envChain, name);
 
   RootedObject obj(cx);
   RootedObject holder(cx);
   Rooted<PropertyResult> prop(cx);
   if (!LookupName(cx, name, envChain, &obj, &holder, &prop)) {
     return false;
   }
 
@@ -412,45 +446,45 @@ bool IonGetNameIC::update(JSContext* cx,
 
 /* static */
 JSObject* IonBindNameIC::update(JSContext* cx, HandleScript outerScript,
                                 IonBindNameIC* ic, HandleObject envChain) {
   IonScript* ionScript = outerScript->ionScript();
   jsbytecode* pc = ic->pc();
   RootedPropertyName name(cx, ic->script()->getName(pc));
 
-  TryAttachIonStub<BindNameIRGenerator, IonBindNameIC>(cx, ic, ionScript,
-                                                       envChain, name);
+  TryAttachIonStubOld<BindNameIRGenerator, IonBindNameIC>(cx, ic, ionScript,
+                                                          envChain, name);
 
   RootedObject holder(cx);
   if (!LookupNameUnqualified(cx, name, envChain, &holder)) {
     return nullptr;
   }
 
   return holder;
 }
 
 /* static */
 JSObject* IonGetIteratorIC::update(JSContext* cx, HandleScript outerScript,
                                    IonGetIteratorIC* ic, HandleValue value) {
   IonScript* ionScript = outerScript->ionScript();
 
-  TryAttachIonStub<GetIteratorIRGenerator, IonGetIteratorIC>(cx, ic, ionScript,
-                                                             value);
+  TryAttachIonStubOld<GetIteratorIRGenerator, IonGetIteratorIC>(
+      cx, ic, ionScript, value);
 
   return ValueToIterator(cx, value);
 }
 
 /* static */
 bool IonHasOwnIC::update(JSContext* cx, HandleScript outerScript,
                          IonHasOwnIC* ic, HandleValue val, HandleValue idVal,
                          int32_t* res) {
   IonScript* ionScript = outerScript->ionScript();
 
-  TryAttachIonStub<HasPropIRGenerator, IonHasOwnIC>(
+  TryAttachIonStubOld<HasPropIRGenerator, IonHasOwnIC>(
       cx, ic, ionScript, CacheKind::HasOwn, idVal, val);
 
   bool found;
   if (!HasOwnProperty(cx, val, idVal, &found)) {
     return false;
   }
 
   *res = found;
@@ -458,29 +492,29 @@ bool IonHasOwnIC::update(JSContext* cx, 
 }
 
 /* static */
 bool IonInIC::update(JSContext* cx, HandleScript outerScript, IonInIC* ic,
                      HandleValue key, HandleObject obj, bool* res) {
   IonScript* ionScript = outerScript->ionScript();
   RootedValue objV(cx, ObjectValue(*obj));
 
-  TryAttachIonStub<HasPropIRGenerator, IonInIC>(cx, ic, ionScript,
-                                                CacheKind::In, key, objV);
+  TryAttachIonStubOld<HasPropIRGenerator, IonInIC>(cx, ic, ionScript,
+                                                   CacheKind::In, key, objV);
 
   return OperatorIn(cx, key, obj, res);
 }
 /* static */
 bool IonInstanceOfIC::update(JSContext* cx, HandleScript outerScript,
                              IonInstanceOfIC* ic, HandleValue lhs,
                              HandleObject rhs, bool* res) {
   IonScript* ionScript = outerScript->ionScript();
 
-  TryAttachIonStub<InstanceOfIRGenerator, IonInstanceOfIC>(cx, ic, ionScript,
-                                                           lhs, rhs);
+  TryAttachIonStubOld<InstanceOfIRGenerator, IonInstanceOfIC>(cx, ic, ionScript,
+                                                              lhs, rhs);
 
   return HasInstance(cx, rhs, lhs, res);
 }
 
 /*  static */
 bool IonUnaryArithIC::update(JSContext* cx, HandleScript outerScript,
                              IonUnaryArithIC* ic, HandleValue val,
                              MutableHandleValue res) {
@@ -516,18 +550,18 @@ bool IonUnaryArithIC::update(JSContext* 
         return false;
       }
       break;
     }
     default:
       MOZ_CRASH("Unexpected op");
   }
 
-  TryAttachIonStub<UnaryArithIRGenerator, IonUnaryArithIC>(cx, ic, ionScript,
-                                                           op, val, res);
+  TryAttachIonStubOld<UnaryArithIRGenerator, IonUnaryArithIC>(cx, ic, ionScript,
+                                                              op, val, res);
 
   return true;
 }
 
 /* static */
 bool IonBinaryArithIC::update(JSContext* cx, HandleScript outerScript,
                               IonBinaryArithIC* ic, HandleValue lhs,
                               HandleValue rhs, MutableHandleValue ret) {
@@ -586,18 +620,18 @@ bool IonBinaryArithIC::update(JSContext*
         return false;
       }
       break;
     }
     default:
       MOZ_CRASH("Unhandled binary arith op");
   }
 
-  TryAttachIonStub<BinaryArithIRGenerator, IonBinaryArithIC>(cx, ic, ionScript,
-                                                             op, lhs, rhs, ret);
+  TryAttachIonStubOld<BinaryArithIRGenerator, IonBinaryArithIC>(
+      cx, ic, ionScript, op, lhs, rhs, ret);
 
   return true;
 }
 
 /* static */
 bool IonCompareIC::update(JSContext* cx, HandleScript outerScript,
                           IonCompareIC* ic, HandleValue lhs, HandleValue rhs,
                           bool* res) {
@@ -653,18 +687,18 @@ bool IonCompareIC::update(JSContext* cx,
         return false;
       }
       break;
     default:
       MOZ_ASSERT_UNREACHABLE("Unhandled ion compare op");
       return false;
   }
 
-  TryAttachIonStub<CompareIRGenerator, IonCompareIC>(cx, ic, ionScript, op, lhs,
-                                                     rhs);
+  TryAttachIonStubOld<CompareIRGenerator, IonCompareIC>(cx, ic, ionScript, op,
+                                                        lhs, rhs);
 
   return true;
 }
 
 uint8_t* IonICStub::stubDataStart() {
   return reinterpret_cast<uint8_t*>(this) + stubInfo_->stubDataOffset();
 }