Bug 1479603 - [Part 1] Cleanup IC code as we show SharedICs the door. r=jandem
authorMatthew Gaudet <mgaudet@mozilla.com>
Wed, 15 Aug 2018 17:54:31 -0700
changeset 488226 7518b4bbc6c740d8f63c1cfaf765c9e136b6c011
parent 488225 fe72a77d866db978bddf7f008d5bd2863613bb02
child 488227 402c68b550d1aede856016eee0325f2c4cd75729
push id9719
push userffxbld-merge
push dateFri, 24 Aug 2018 17:49:46 +0000
treeherdermozilla-beta@719ec98fba77 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1479603
milestone63.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1479603 - [Part 1] Cleanup IC code as we show SharedICs the door. r=jandem - Move SimpleTypeDescrKey functions into CacheIR.h. This matches the set of callers - Move LoadTypedThingData into CacheIRCompiler, matching usage - Push definition of StripPreliminaryObjectStubs up in file, and remove header declaration - Consolidate LoadTypedThingLength into CacheIR files - Remove now dead ICMultiStubCompiler - Remove BinarySharedStub classes. Can do this now that Compare and BinaryArith ICs have been converted to CacheIR - Rename comapreSharedStub, and use correct flag to disable it. - Remove SharedStubInfo - Collapse SharedICList.h back into SharedIC.h - Remove unimplemented declaration
js/src/jit/BaselineIC.cpp
js/src/jit/BaselineICList.h
js/src/jit/CacheIR.h
js/src/jit/CacheIRCompiler.cpp
js/src/jit/CacheIRCompiler.h
js/src/jit/CodeGenerator.cpp
js/src/jit/IonBuilder.cpp
js/src/jit/Lowering.cpp
js/src/jit/MIR.h
js/src/jit/SharedIC.cpp
js/src/jit/SharedIC.h
js/src/jit/SharedICList.h
js/src/jit/shared/LIR-shared.h
js/src/jit/shared/Lowering-shared-inl.h
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -543,16 +543,38 @@ ICToNumber_Fallback::Compiler::generateS
 
     // Push arguments.
     masm.pushValue(R0);
     masm.push(ICStubReg);
 
     return tailCallVM(DoToNumberFallbackInfo, masm);
 }
 
+static void
+StripPreliminaryObjectStubs(JSContext* cx, ICFallbackStub* stub)
+{
+    // Before the new script properties analysis has been performed on a type,
+    // all instances of that type have the maximum number of fixed slots.
+    // Afterwards, the objects (even the preliminary ones) might be changed
+    // to reduce the number of fixed slots they have. If we generate stubs for
+    // both the old and new number of fixed slots, the stub will look
+    // polymorphic to IonBuilder when it is actually monomorphic. To avoid
+    // this, strip out any stubs for preliminary objects before attaching a new
+    // stub which isn't on a preliminary object.
+
+    for (ICStubIterator iter = stub->beginChain(); !iter.atEnd(); iter++) {
+        if (iter->isCacheIR_Regular() && iter->toCacheIR_Regular()->hasPreliminaryObject())
+            iter.unlink(cx);
+        else if (iter->isCacheIR_Monitored() && iter->toCacheIR_Monitored()->hasPreliminaryObject())
+            iter.unlink(cx);
+        else if (iter->isCacheIR_Updated() && iter->toCacheIR_Updated()->hasPreliminaryObject())
+            iter.unlink(cx);
+    }
+}
+
 //
 // GetElem_Fallback
 //
 
 static bool
 DoGetElemFallback(JSContext* cx, BaselineFrame* frame, ICGetElem_Fallback* stub_, HandleValue lhs,
                   HandleValue rhs, MutableHandleValue res)
 {
@@ -760,32 +782,16 @@ ICGetElem_Fallback::Compiler::generateSt
     masm.pushValue(R1);
     masm.pushValue(R0);
     masm.push(ICStubReg);
     pushStubPayload(masm, R0.scratchReg());
 
     return tailCallVM(DoGetElemFallbackInfo, masm);
 }
 
-void
-LoadTypedThingLength(MacroAssembler& masm, TypedThingLayout layout, Register obj, Register result)
-{
-    switch (layout) {
-      case Layout_TypedArray:
-        masm.unboxInt32(Address(obj, TypedArrayObject::lengthOffset()), result);
-        break;
-      case Layout_OutlineTypedObject:
-      case Layout_InlineTypedObject:
-        masm.loadTypedObjectLength(obj, result);
-        break;
-      default:
-        MOZ_CRASH();
-    }
-}
-
 static void
 SetUpdateStubData(ICCacheIR_Updated* stub, const PropertyTypeCheckInfo* info)
 {
     if (info->isSet()) {
         stub->updateStubGroup() = info->group();
         stub->updateStubId() = info->id();
     }
 }
@@ -1428,38 +1434,16 @@ ICGetIntrinsic_Fallback::Compiler::gener
 
     return tailCallVM(DoGetIntrinsicFallbackInfo, masm);
 }
 
 //
 // GetProp_Fallback
 //
 
-void
-StripPreliminaryObjectStubs(JSContext* cx, ICFallbackStub* stub)
-{
-    // Before the new script properties analysis has been performed on a type,
-    // all instances of that type have the maximum number of fixed slots.
-    // Afterwards, the objects (even the preliminary ones) might be changed
-    // to reduce the number of fixed slots they have. If we generate stubs for
-    // both the old and new number of fixed slots, the stub will look
-    // polymorphic to IonBuilder when it is actually monomorphic. To avoid
-    // this, strip out any stubs for preliminary objects before attaching a new
-    // stub which isn't on a preliminary object.
-
-    for (ICStubIterator iter = stub->beginChain(); !iter.atEnd(); iter++) {
-        if (iter->isCacheIR_Regular() && iter->toCacheIR_Regular()->hasPreliminaryObject())
-            iter.unlink(cx);
-        else if (iter->isCacheIR_Monitored() && iter->toCacheIR_Monitored()->hasPreliminaryObject())
-            iter.unlink(cx);
-        else if (iter->isCacheIR_Updated() && iter->toCacheIR_Updated()->hasPreliminaryObject())
-            iter.unlink(cx);
-    }
-}
-
 static bool
 ComputeGetPropResult(JSContext* cx, BaselineFrame* frame, JSOp op, HandlePropertyName name,
                      MutableHandleValue val, MutableHandleValue res)
 {
     // Handle arguments.length and arguments.callee on optimized arguments, as
     // it is not an object.
     if (val.isMagic(JS_OPTIMIZED_ARGUMENTS) && IsOptimizedArguments(frame, val)) {
         if (op == JSOP_LENGTH) {
@@ -5187,43 +5171,40 @@ ICNewArray_Fallback::Compiler::generateS
 
     return tailCallVM(DoNewArrayInfo, masm);
 }
 
 //
 // NewObject_Fallback
 //
 static bool
-DoNewObject(JSContext* cx, void* payload, ICNewObject_Fallback* stub, MutableHandleValue res)
+DoNewObject(JSContext* cx, BaselineFrame* frame, ICNewObject_Fallback* stub, MutableHandleValue res)
 {
-    SharedStubInfo info(cx, payload, stub->icEntry());
-
     FallbackICSpew(cx, stub, "NewObject");
 
     RootedObject obj(cx);
 
     RootedObject templateObject(cx, stub->templateObject());
     if (templateObject) {
         MOZ_ASSERT(!templateObject->group()->maybePreliminaryObjectsDontCheckGeneration());
         obj = NewObjectOperationWithTemplate(cx, templateObject);
     } else {
-        HandleScript script = info.script();
-        jsbytecode* pc = info.pc();
+        RootedScript script(cx, frame->script());
+        jsbytecode* pc = stub->icEntry()->pc(script);
         obj = NewObjectOperation(cx, script, pc);
 
         if (obj && !obj->isSingleton() &&
             !obj->group()->maybePreliminaryObjectsDontCheckGeneration())
         {
             templateObject = NewObjectOperation(cx, script, pc, TenuredObject);
             if (!templateObject)
                 return false;
 
             if (!JitOptions.disableCacheIR) {
                 bool attached = false;
-                RootedScript script(cx, info.outerScript(cx));
                 NewObjectIRGenerator gen(cx, script, pc, stub->state().mode(), JSOp(*pc), templateObject);
                 if (gen.tryAttachStub()) {
                     ICStub* newStub = AttachBaselineCacheIRStub(cx, gen.writerRef(), gen.cacheKind(),
                                                                 BaselineCacheIRStubKind::Regular,
                                                                 ICStubEngine::Baseline , script, stub, &attached);
                     if (newStub)
                         JitSpew(JitSpew_BaselineIC, "  NewObject Attached CacheIR stub");
                 }
@@ -5234,17 +5215,17 @@ DoNewObject(JSContext* cx, void* payload
 
     if (!obj)
         return false;
 
     res.setObject(*obj);
     return true;
 }
 
-typedef bool(*DoNewObjectFn)(JSContext*, void*, ICNewObject_Fallback*, MutableHandleValue);
+typedef bool(*DoNewObjectFn)(JSContext*, BaselineFrame*, ICNewObject_Fallback*, MutableHandleValue);
 static const VMFunction DoNewObjectInfo =
     FunctionInfo<DoNewObjectFn>(DoNewObject, "DoNewObject", TailCall);
 
 bool
 ICNewObject_Fallback::Compiler::generateStubCode(MacroAssembler& masm)
 {
     EmitRestoreTailCallReg(masm);
 
--- a/js/src/jit/BaselineICList.h
+++ b/js/src/jit/BaselineICList.h
@@ -70,15 +70,25 @@ namespace jit {
                                                  \
     _(InstanceOf_Fallback)                       \
     _(InstanceOf_Function)                       \
                                                  \
     _(TypeOf_Fallback)                           \
                                                  \
     _(Rest_Fallback)                             \
                                                  \
+    _(BinaryArith_Fallback)                      \
+                                                 \
+    _(Compare_Fallback)                          \
+                                                 \
+    _(GetProp_Fallback)                          \
+                                                 \
     _(RetSub_Fallback)                           \
-    _(RetSub_Resume)
+    _(RetSub_Resume)                             \
+                                                 \
+    _(CacheIR_Regular)                           \
+    _(CacheIR_Monitored)                         \
+    _(CacheIR_Updated)                           \
 
 } // namespace jit
 } // namespace js
  
 #endif /* jit_BaselineICList_h */
--- a/js/src/jit/CacheIR.h
+++ b/js/src/jit/CacheIR.h
@@ -417,16 +417,23 @@ enum class GuardClassKind : uint8_t
 };
 
 // Some ops refer to shapes that might be in other zones. Instead of putting
 // cross-zone pointers in the caches themselves (which would complicate tracing
 // enormously), these ops instead contain wrappers for objects in the target
 // zone, which refer to the actual shape via a reserved slot.
 JSObject* NewWrapperWithObjectShape(JSContext* cx, HandleNativeObject obj);
 
+// Enum for stubs handling a combination of typed arrays and typed objects.
+enum TypedThingLayout {
+    Layout_TypedArray,
+    Layout_OutlineTypedObject,
+    Layout_InlineTypedObject
+};
+
 void LoadShapeWrapperContents(MacroAssembler& masm, Register obj, Register dst, Label* failure);
 
 // Class to record CacheIR + some additional metadata for code generation.
 class MOZ_RAII CacheIRWriter : public JS::CustomAutoRooter
 {
     JSContext* cx_;
     CompactBufferWriter buffer_;
 
@@ -1971,12 +1978,41 @@ class MOZ_RAII NewObjectIRGenerator : pu
 
   public:
     NewObjectIRGenerator(JSContext* cx, HandleScript, jsbytecode* pc, ICState::Mode,
                          JSOp op, HandleObject templateObj);
 
     bool tryAttachStub();
 };
 
+static inline uint32_t
+SimpleTypeDescrKey(SimpleTypeDescr* descr)
+{
+    if (descr->is<ScalarTypeDescr>())
+        return uint32_t(descr->as<ScalarTypeDescr>().type()) << 1;
+    return (uint32_t(descr->as<ReferenceTypeDescr>().type()) << 1) | 1;
+}
+
+inline bool
+SimpleTypeDescrKeyIsScalar(uint32_t key)
+{
+    return !(key & 1);
+}
+
+inline ScalarTypeDescr::Type
+ScalarTypeFromSimpleTypeDescrKey(uint32_t key)
+{
+    MOZ_ASSERT(SimpleTypeDescrKeyIsScalar(key));
+    return ScalarTypeDescr::Type(key >> 1);
+}
+
+inline ReferenceType
+ReferenceTypeFromSimpleTypeDescrKey(uint32_t key)
+{
+    MOZ_ASSERT(!SimpleTypeDescrKeyIsScalar(key));
+    return ReferenceType(key >> 1);
+}
+
+
 } // namespace jit
 } // namespace js
 
 #endif /* jit_CacheIR_h */
--- a/js/src/jit/CacheIRCompiler.cpp
+++ b/js/src/jit/CacheIRCompiler.cpp
@@ -3793,8 +3793,42 @@ CacheIRCompiler::emitGuardGroupHasUnanal
 bool
 CacheIRCompiler::emitLoadObject()
 {
     Register reg = allocator.defineRegister(masm, reader.objOperandId());
     StubFieldOffset obj(reader.stubOffset(), StubField::Type::JSObject);
     emitLoadStubField(obj, reg);
     return true;
 }
+
+void
+js::jit::LoadTypedThingData(MacroAssembler& masm, TypedThingLayout layout, Register obj, Register result)
+{
+    switch (layout) {
+      case Layout_TypedArray:
+        masm.loadPtr(Address(obj, TypedArrayObject::dataOffset()), result);
+        break;
+      case Layout_OutlineTypedObject:
+        masm.loadPtr(Address(obj, OutlineTypedObject::offsetOfData()), result);
+        break;
+      case Layout_InlineTypedObject:
+        masm.computeEffectiveAddress(Address(obj, InlineTypedObject::offsetOfDataStart()), result);
+        break;
+      default:
+        MOZ_CRASH();
+    }
+}
+
+void
+js::jit::LoadTypedThingLength(MacroAssembler& masm, TypedThingLayout layout, Register obj, Register result)
+{
+    switch (layout) {
+      case Layout_TypedArray:
+        masm.unboxInt32(Address(obj, TypedArrayObject::lengthOffset()), result);
+        break;
+      case Layout_OutlineTypedObject:
+      case Layout_InlineTypedObject:
+        masm.loadTypedObjectLength(obj, result);
+        break;
+      default:
+        MOZ_CRASH();
+    }
+}
\ No newline at end of file
--- a/js/src/jit/CacheIRCompiler.h
+++ b/js/src/jit/CacheIRCompiler.h
@@ -897,12 +897,18 @@ class CacheIRStubInfo
     uintptr_t getStubRawWord(ICStub* stub, uint32_t field) const;
 
     void copyStubData(ICStub* src, ICStub* dest) const;
 };
 
 template <typename T>
 void TraceCacheIRStub(JSTracer* trc, T* stub, const CacheIRStubInfo* stubInfo);
 
+void
+LoadTypedThingData(MacroAssembler& masm, TypedThingLayout layout, Register obj, Register result);
+
+void
+LoadTypedThingLength(MacroAssembler& masm, TypedThingLayout layout, Register obj, Register result);
+
 } // namespace jit
 } // namespace js
 
 #endif /* jit_CacheIRCompiler_h */
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -2935,44 +2935,16 @@ CodeGenerator::visitBinaryCache(LBinaryC
         return;
       }
       default:
         MOZ_CRASH("Unsupported jsop in MBinaryCache");
     }
 }
 
 void
-CodeGenerator::visitBinarySharedStub(LBinarySharedStub* lir)
-{
-    JSOp jsop = JSOp(*lir->mirRaw()->toInstruction()->resumePoint()->pc());
-    switch (jsop) {
-      case JSOP_ADD:
-      case JSOP_SUB:
-      case JSOP_MUL:
-      case JSOP_DIV:
-      case JSOP_MOD:
-      case JSOP_POW:
-        emitSharedStub(ICStub::Kind::BinaryArith_Fallback, lir);
-        break;
-      case JSOP_LT:
-      case JSOP_LE:
-      case JSOP_GT:
-      case JSOP_GE:
-      case JSOP_EQ:
-      case JSOP_NE:
-      case JSOP_STRICTEQ:
-      case JSOP_STRICTNE:
-        emitSharedStub(ICStub::Kind::Compare_Fallback, lir);
-        break;
-      default:
-        MOZ_CRASH("Unsupported jsop in shared stubs.");
-    }
-}
-
-void
 CodeGenerator::visitUnaryCache(LUnaryCache* lir)
 {
     LiveRegisterSet liveRegs = lir->safepoint()->liveRegs();
     TypedOrValueRegister input = TypedOrValueRegister(ToValue(lir, LUnaryCache::Input));
     ValueOperand output = ToOutValue(lir);
 
     IonUnaryArithIC ic(liveRegs, input, output);
     addIC(lir, allocateIC(ic));
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -6109,19 +6109,18 @@ IonBuilder::compareTrySpecializedOnBasel
     return Ok();
 }
 
 AbortReasonOr<Ok>
 IonBuilder::compareTryBinaryStub(bool* emitted, MDefinition* left, MDefinition* right)
 {
     MOZ_ASSERT(*emitted == false);
 
-    // Try to emit a shared stub cache.
-
-    if (JitOptions.disableSharedStubs)
+    // Try to emit a CacheIR Stub.
+    if (JitOptions.disableCacheIR)
         return Ok();
 
     if (JSOp(*pc) == JSOP_CASE || IsCallPC(pc))
         return Ok();
 
     MBinaryCache* stub = MBinaryCache::New(alloc(), left, right);
     current->add(stub);
     current->push(stub);
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -2524,32 +2524,16 @@ LIRGenerator::visitBinaryCache(MBinaryCa
     LBinaryCache* lir = new(alloc()) LBinaryCache(useBox(lhs),
                                                   useBox(rhs),
                                                   tempFixed(FloatReg0),
                                                   tempFixed(FloatReg1));
     defineBox(lir, ins);
     assignSafepoint(lir, ins);
 }
 
-
-void
-LIRGenerator::visitBinarySharedStub(MBinarySharedStub* ins)
-{
-    MDefinition* lhs = ins->getOperand(0);
-    MDefinition* rhs = ins->getOperand(1);
-
-    MOZ_ASSERT(ins->type() == MIRType::Value);
-    MOZ_ASSERT(ins->type() == MIRType::Value);
-
-    LBinarySharedStub* lir = new(alloc()) LBinarySharedStub(useBoxFixedAtStart(lhs, R0),
-                                                            useBoxFixedAtStart(rhs, R1));
-    defineSharedStubReturn(lir, ins);
-    assignSafepoint(lir, ins);
-}
-
 void
 LIRGenerator::visitUnaryCache(MUnaryCache* ins)
 {
     MDefinition* input = ins->getOperand(0);
     MOZ_ASSERT(ins->type() == MIRType::Value);
 
     LUnaryCache* lir = new(alloc()) LUnaryCache(useBox(input));
     defineBox(lir, ins);
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -7107,32 +7107,16 @@ class MOsrReturnValue
     INSTRUCTION_HEADER(OsrReturnValue)
     TRIVIAL_NEW_WRAPPERS
 
     MOsrEntry* entry() {
         return getOperand(0)->toOsrEntry();
     }
 };
 
-class MBinarySharedStub
-  : public MBinaryInstruction,
-    public MixPolicy<BoxPolicy<0>, BoxPolicy<1> >::Data
-{
-  protected:
-    explicit MBinarySharedStub(MDefinition* left, MDefinition* right)
-      : MBinaryInstruction(classOpcode, left, right)
-    {
-        setResultType(MIRType::Value);
-    }
-
-  public:
-    INSTRUCTION_HEADER(BinarySharedStub)
-    TRIVIAL_NEW_WRAPPERS
-};
-
 class MBinaryCache
   : public MBinaryInstruction,
     public MixPolicy<BoxPolicy<0>, BoxPolicy<1> >::Data
 {
   protected:
     explicit MBinaryCache(MDefinition* left, MDefinition* right)
       : MBinaryInstruction(classOpcode, left, right)
     {
--- a/js/src/jit/SharedIC.cpp
+++ b/js/src/jit/SharedIC.cpp
@@ -633,68 +633,18 @@ ICStubCompiler::pushStubPayload(MacroAss
 
 void
 ICStubCompiler::PushStubPayload(MacroAssembler& masm, Register scratch)
 {
     pushStubPayload(masm, scratch);
     masm.adjustFrame(sizeof(intptr_t));
 }
 
-SharedStubInfo::SharedStubInfo(JSContext* cx, void* payload, ICEntry* icEntry)
-  : maybeFrame_(nullptr),
-    outerScript_(cx),
-    innerScript_(cx),
-    icEntry_(icEntry)
-{
-    if (payload) {
-        maybeFrame_ = (BaselineFrame*) payload;
-        outerScript_ = maybeFrame_->script();
-        innerScript_ = maybeFrame_->script();
-    } else {
-        IonICEntry* entry = (IonICEntry*) icEntry;
-        innerScript_ = entry->script();
-        // outerScript_ is initialized lazily.
-    }
-}
-
-HandleScript
-SharedStubInfo::outerScript(JSContext* cx)
-{
-    if (!outerScript_) {
-        js::jit::JitActivationIterator actIter(cx);
-        JSJitFrameIter it(actIter->asJit());
-        MOZ_ASSERT(it.isExitFrame());
-        ++it;
-        MOZ_ASSERT(it.isIonJS());
-        outerScript_ = it.script();
-        MOZ_ASSERT(!it.ionScript()->invalidated());
-    }
-    return outerScript_;
-}
-
 //
 void
-LoadTypedThingData(MacroAssembler& masm, TypedThingLayout layout, Register obj, Register result)
-{
-    switch (layout) {
-      case Layout_TypedArray:
-        masm.loadPtr(Address(obj, TypedArrayObject::dataOffset()), result);
-        break;
-      case Layout_OutlineTypedObject:
-        masm.loadPtr(Address(obj, OutlineTypedObject::offsetOfData()), result);
-        break;
-      case Layout_InlineTypedObject:
-        masm.computeEffectiveAddress(Address(obj, InlineTypedObject::offsetOfDataStart()), result);
-        break;
-      default:
-        MOZ_CRASH();
-    }
-}
-
-void
 BaselineScript::noteAccessedGetter(uint32_t pcOffset)
 {
     ICEntry& entry = icEntryFromPCOffset(pcOffset);
     ICFallbackStub* stub = entry.fallbackStub();
 
     if (stub->isGetProp_Fallback())
         stub->toGetProp_Fallback()->noteAccessedGetter();
 }
--- a/js/src/jit/SharedIC.h
+++ b/js/src/jit/SharedIC.h
@@ -7,17 +7,16 @@
 #ifndef jit_SharedIC_h
 #define jit_SharedIC_h
 
 #include "gc/GC.h"
 #include "jit/BaselineICList.h"
 #include "jit/BaselineJIT.h"
 #include "jit/ICState.h"
 #include "jit/MacroAssembler.h"
-#include "jit/SharedICList.h"
 #include "jit/SharedICRegisters.h"
 #include "vm/JSContext.h"
 #include "vm/Realm.h"
 #include "vm/ReceiverGuard.h"
 #include "vm/TypedArrayObject.h"
 
 namespace js {
 namespace jit {
@@ -190,19 +189,19 @@ namespace jit {
 //     +-----------+     +-----------+     +-----------+
 //     | Type 1.1  |---->| Type 1.2  |---->|   FB 1    |
 //     +-----------+     +-----------+     +-----------+
 //
 
 class ICStub;
 class ICFallbackStub;
 
+
 #define FORWARD_DECLARE_STUBS(kindName) class IC##kindName;
     IC_BASELINE_STUB_KIND_LIST(FORWARD_DECLARE_STUBS)
-    IC_SHARED_STUB_KIND_LIST(FORWARD_DECLARE_STUBS)
 #undef FORWARD_DECLARE_STUBS
 
 #ifdef JS_JITSPEW
 void FallbackICSpew(JSContext* cx, ICFallbackStub* stub, const char* fmt, ...)
     MOZ_FORMAT_PRINTF(3, 4);
 void TypeFallbackICSpew(JSContext* cx, ICTypeMonitor_Fallback* stub, const char* fmt, ...)
     MOZ_FORMAT_PRINTF(3, 4);
 #else
@@ -494,33 +493,31 @@ class ICStub
 {
     friend class ICFallbackStub;
 
   public:
     enum Kind {
         INVALID = 0,
 #define DEF_ENUM_KIND(kindName) kindName,
         IC_BASELINE_STUB_KIND_LIST(DEF_ENUM_KIND)
-        IC_SHARED_STUB_KIND_LIST(DEF_ENUM_KIND)
 #undef DEF_ENUM_KIND
         LIMIT
     };
 
     static bool IsValidKind(Kind k) {
         return (k > INVALID) && (k < LIMIT);
     }
     static bool IsCacheIRKind(Kind k) {
         return k == CacheIR_Regular || k == CacheIR_Monitored || k == CacheIR_Updated;
     }
 
     static const char* KindString(Kind k) {
         switch(k) {
 #define DEF_KIND_STR(kindName) case kindName: return #kindName;
             IC_BASELINE_STUB_KIND_LIST(DEF_KIND_STR)
-            IC_SHARED_STUB_KIND_LIST(DEF_KIND_STR)
 #undef DEF_KIND_STR
           default:
             MOZ_CRASH("Invalid kind.");
         }
     }
 
     enum Trait {
         Regular             = 0x0,
@@ -654,17 +651,16 @@ class ICStub
         MOZ_ASSERT(is##kindName()); \
         return reinterpret_cast<const IC##kindName*>(this); \
     } \
     inline IC##kindName* to##kindName() { \
         MOZ_ASSERT(is##kindName()); \
         return reinterpret_cast<IC##kindName*>(this); \
     }
     IC_BASELINE_STUB_KIND_LIST(KIND_METHODS)
-    IC_SHARED_STUB_KIND_LIST(KIND_METHODS)
 #undef KIND_METHODS
 
     inline ICStub* next() const {
         return next_;
     }
 
     inline bool hasNext() const {
         return next_ != nullptr;
@@ -1077,21 +1073,16 @@ class ICStubCompiler
 
     // A stub frame is used when a stub wants to call into the VM without
     // performing a tail call. This is required for the return address
     // to pc mapping to work.
     void enterStubFrame(MacroAssembler& masm, Register scratch);
     void assumeStubFrame();
     void leaveStubFrame(MacroAssembler& masm, bool calledIntoIon = false);
 
-    // Some stubs need to emit Gecko Profiler updates.  This emits the guarding
-    // jitcode for those stubs.  If profiling is not enabled, jumps to the
-    // given label.
-    void guardProfilingEnabled(MacroAssembler& masm, Register scratch, Label* skip);
-
   public:
     static inline AllocatableGeneralRegisterSet availableGeneralRegs(size_t numInputs) {
         AllocatableGeneralRegisterSet regs(GeneralRegisterSet::All());
 #if defined(JS_CODEGEN_ARM)
         MOZ_ASSERT(!regs.has(BaselineStackReg));
         MOZ_ASSERT(!regs.has(ICTailCallReg));
         regs.take(BaselineSecondScratchReg);
 #elif defined(JS_CODEGEN_MIPS32) || defined(JS_CODEGEN_MIPS64)
@@ -1146,66 +1137,16 @@ class ICStubCompiler
         }
         return outerScript->zone()->jitZone()->optimizedStubSpace();
     }
     ICStubSpace* getStubSpace(JSScript* outerScript) {
         return StubSpaceForStub(ICStub::NonCacheIRStubMakesGCCalls(kind), outerScript, engine_);
     }
 };
 
-class SharedStubInfo
-{
-    BaselineFrame* maybeFrame_;
-    RootedScript outerScript_;
-    RootedScript innerScript_;
-    ICEntry* icEntry_;
-
-  public:
-    SharedStubInfo(JSContext* cx, void* payload, ICEntry* entry);
-
-    ICStubCompiler::Engine engine() const {
-        return maybeFrame_
-               ? ICStubCompiler::Engine::Baseline
-               : ICStubCompiler::Engine::IonSharedIC;
-    }
-
-    HandleScript script() const {
-        MOZ_ASSERT(innerScript_);
-        return innerScript_;
-    }
-
-    HandleScript innerScript() const {
-        MOZ_ASSERT(innerScript_);
-        return innerScript_;
-    }
-
-    HandleScript outerScript(JSContext* cx);
-
-    jsbytecode* pc() const {
-        return icEntry()->pc(innerScript());
-    }
-
-    uint32_t pcOffset() const {
-        return script()->pcToOffset(pc());
-    }
-
-    BaselineFrame* frame() const {
-        MOZ_ASSERT(maybeFrame_);
-        return maybeFrame_;
-    }
-
-    BaselineFrame* maybeFrame() const {
-        return maybeFrame_;
-    }
-
-    ICEntry* icEntry() const {
-        return icEntry_;
-    }
-};
-
 // Monitored fallback stubs - as the name implies.
 class ICMonitoredFallbackStub : public ICFallbackStub
 {
   protected:
     // Pointer to the fallback monitor stub. Created lazily by
     // getFallbackMonitorStub if needed.
     ICTypeMonitor_Fallback* fallbackMonitorStub_;
 
@@ -1228,36 +1169,16 @@ class ICMonitoredFallbackStub : public I
         return fallbackMonitorStub_;
     }
 
     static inline size_t offsetOfFallbackMonitorStub() {
         return offsetof(ICMonitoredFallbackStub, fallbackMonitorStub_);
     }
 };
 
-
-// Base class for stub compilers that can generate multiple stubcodes.
-// These compilers need access to the JSOp they are compiling for.
-class ICMultiStubCompiler : public ICStubCompiler
-{
-  protected:
-    JSOp op;
-
-    // Stub keys for multi-stub kinds are composed of both the kind
-    // and the op they are compiled for.
-    virtual int32_t getKey() const override {
-        return static_cast<int32_t>(engine_) |
-              (static_cast<int32_t>(kind) << 1) |
-              (static_cast<int32_t>(op) << 17);
-    }
-
-    ICMultiStubCompiler(JSContext* cx, ICStub::Kind kind, JSOp op, Engine engine)
-      : ICStubCompiler(cx, kind, engine), op(op) {}
-};
-
 // TypeCheckPrimitiveSetStub
 //   Base class for IC stubs (TypeUpdate or TypeMonitor) that check that a given
 //   value's type falls within a set of primitive types.
 
 class TypeCheckPrimitiveSetStub : public ICStub
 {
     friend class ICStubSpace;
   protected:
@@ -1680,31 +1601,16 @@ class ICCompare_Fallback : public ICFall
           : ICStubCompiler(cx, ICStub::Compare_Fallback, engine) {}
 
         ICStub* getStub(ICStubSpace* space) override {
             return newStub<ICCompare_Fallback>(space, getStubCode());
         }
     };
 };
 
-// Enum for stubs handling a combination of typed arrays and typed objects.
-enum TypedThingLayout {
-    Layout_TypedArray,
-    Layout_OutlineTypedObject,
-    Layout_InlineTypedObject
-};
-
-void
-StripPreliminaryObjectStubs(JSContext* cx, ICFallbackStub* stub);
-
-void
-LoadTypedThingData(MacroAssembler& masm, TypedThingLayout layout, Register obj, Register result);
-
-void
-LoadTypedThingLength(MacroAssembler& masm, TypedThingLayout layout, Register obj, Register result);
 
 class ICGetProp_Fallback : public ICMonitoredFallbackStub
 {
     friend class ICStubSpace;
 
     explicit ICGetProp_Fallback(JitCode* stubCode)
       : ICMonitoredFallbackStub(ICStub::GetProp_Fallback, stubCode)
     { }
@@ -1747,40 +1653,12 @@ class ICGetProp_Fallback : public ICMoni
         { }
 
         ICStub* getStub(ICStubSpace* space) override {
             return newStub<ICGetProp_Fallback>(space, getStubCode());
         }
     };
 };
 
-static inline uint32_t
-SimpleTypeDescrKey(SimpleTypeDescr* descr)
-{
-    if (descr->is<ScalarTypeDescr>())
-        return uint32_t(descr->as<ScalarTypeDescr>().type()) << 1;
-    return (uint32_t(descr->as<ReferenceTypeDescr>().type()) << 1) | 1;
-}
-
-inline bool
-SimpleTypeDescrKeyIsScalar(uint32_t key)
-{
-    return !(key & 1);
-}
-
-inline ScalarTypeDescr::Type
-ScalarTypeFromSimpleTypeDescrKey(uint32_t key)
-{
-    MOZ_ASSERT(SimpleTypeDescrKeyIsScalar(key));
-    return ScalarTypeDescr::Type(key >> 1);
-}
-
-inline ReferenceType
-ReferenceTypeFromSimpleTypeDescrKey(uint32_t key)
-{
-    MOZ_ASSERT(!SimpleTypeDescrKeyIsScalar(key));
-    return ReferenceType(key >> 1);
-}
-
 } // namespace jit
 } // namespace js
 
 #endif /* jit_SharedIC_h */
deleted file mode 100644
--- a/js/src/jit/SharedICList.h
+++ /dev/null
@@ -1,29 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sts=4 et sw=4 tw=99:
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef jit_SharedICList_h
-#define jit_SharedICList_h
-
-namespace js {
-namespace jit {
-
-// List of IC stub kinds that can run in Baseline and in IonMonkey
-#define IC_SHARED_STUB_KIND_LIST(_)              \
-    _(BinaryArith_Fallback)                      \
-                                                 \
-    _(Compare_Fallback)                          \
-                                                 \
-    _(GetProp_Fallback)                          \
-                                                 \
-    _(CacheIR_Regular)                           \
-    _(CacheIR_Monitored)                         \
-    _(CacheIR_Updated)                           \
-                                                 \
-
-} // namespace jit
-} // namespace js
-
-#endif /* jit_SharedICList_h */
--- a/js/src/jit/shared/LIR-shared.h
+++ b/js/src/jit/shared/LIR-shared.h
@@ -4791,36 +4791,16 @@ class LStringReplace: public LCallInstru
     const LAllocation* pattern() {
         return getOperand(1);
     }
     const LAllocation* replacement() {
         return getOperand(2);
     }
 };
 
-class LBinarySharedStub : public LCallInstructionHelper<BOX_PIECES, 2 * BOX_PIECES, 0>
-{
-  public:
-    LIR_HEADER(BinarySharedStub)
-
-    LBinarySharedStub(const LBoxAllocation& lhs, const LBoxAllocation& rhs)
-      : LCallInstructionHelper(classOpcode)
-    {
-        setBoxOperand(LhsInput, lhs);
-        setBoxOperand(RhsInput, rhs);
-    }
-
-    const MBinarySharedStub* mir() const {
-        return mir_->toBinarySharedStub();
-    }
-
-    static const size_t LhsInput = 0;
-    static const size_t RhsInput = BOX_PIECES;
-};
-
 class LBinaryCache : public LInstructionHelper<BOX_PIECES, 2 * BOX_PIECES, 2>
 {
   public:
     LIR_HEADER(BinaryCache)
 
     // Takes two temps: these are intendend to be FloatReg0 and FloatReg1
     // To allow the actual cache code to safely clobber those values without
     // save and restore.
--- a/js/src/jit/shared/Lowering-shared-inl.h
+++ b/js/src/jit/shared/Lowering-shared-inl.h
@@ -245,17 +245,17 @@ LIRGeneratorShared::defineInt64(LInstruc
     add(lir);
 }
 
 void
 LIRGeneratorShared::defineSharedStubReturn(LInstruction* lir, MDefinition* mir)
 {
     lir->setMir(mir);
 
-    MOZ_ASSERT(lir->isBinarySharedStub() || lir->isNullarySharedStub());
+    MOZ_ASSERT(lir->isNullarySharedStub());
     MOZ_ASSERT(mir->type() == MIRType::Value);
 
     uint32_t vreg = getVirtualRegister();
 
 #if defined(JS_NUNBOX32)
     lir->setDef(TYPE_INDEX, LDefinition(vreg + VREG_TYPE_OFFSET, LDefinition::TYPE,
                                         LGeneralReg(JSReturnReg_Type)));
     lir->setDef(PAYLOAD_INDEX, LDefinition(vreg + VREG_DATA_OFFSET, LDefinition::PAYLOAD,