Bug 865635 - Use MMonitorTypes instead of MTypeBarrier for type write barriers, r=dvander.
authorBrian Hackett <bhackett1024@gmail.com>
Thu, 25 Apr 2013 14:44:44 -0600
changeset 140917 ebf1b0f1920c0628bb250519aa4a1ae9a14ef406
parent 140916 45e73d8d89c978a0e7967bcb8e915578b8530e97
child 140918 5fb2a77bb0db11a291205c0d0d752b38301fc37e
push id2579
push userakeybl@mozilla.com
push dateMon, 24 Jun 2013 18:52:47 +0000
treeherdermozilla-beta@b69b7de8a05a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdvander
bugs865635
milestone23.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 865635 - Use MMonitorTypes instead of MTypeBarrier for type write barriers, r=dvander.
js/src/ion/Lowering.cpp
js/src/ion/MIR.cpp
js/src/ion/MIR.h
js/src/ion/shared/Lowering-shared-inl.h
--- a/js/src/ion/Lowering.cpp
+++ b/js/src/ion/Lowering.cpp
@@ -1725,17 +1725,17 @@ LIRGenerator::visitTypeBarrier(MTypeBarr
 bool
 LIRGenerator::visitMonitorTypes(MMonitorTypes *ins)
 {
     // Requesting a non-GC pointer is safe here since we never re-enter C++
     // from inside a type check.
     LMonitorTypes *lir = new LMonitorTypes(temp());
     if (!useBox(lir, LMonitorTypes::Input, ins->input()))
         return false;
-    return assignSnapshot(lir, Bailout_Monitor) && add(lir, ins);
+    return assignSnapshot(lir, Bailout_Normal) && add(lir, ins);
 }
 
 bool
 LIRGenerator::visitArrayLength(MArrayLength *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     return define(new LArrayLength(useRegisterAtStart(ins->elements())), ins);
 }
--- a/js/src/ion/MIR.cpp
+++ b/js/src/ion/MIR.cpp
@@ -2468,19 +2468,18 @@ TryAddTypeBarrierForWrite(JSContext *cx,
 
     if ((*pvalue)->type() != MIRType_Value)
         return false;
 
     types::StackTypeSet *types = aggregateProperty->clone(GetIonContext()->temp->lifoAlloc());
     if (!types)
         return false;
 
-    MInstruction *ins = MTypeBarrier::New(*pvalue, types, Bailout_Normal);
+    MInstruction *ins = MMonitorTypes::New(*pvalue, types);
     current->add(ins);
-    *pvalue = ins;
     return true;
 }
 
 static MInstruction *
 AddTypeGuard(MBasicBlock *current, MDefinition *obj, types::TypeObject *typeObject,
              bool bailOnEquality)
 {
     MGuardObjectType *guard = MGuardObjectType::New(obj, typeObject, bailOnEquality);
--- a/js/src/ion/MIR.h
+++ b/js/src/ion/MIR.h
@@ -6873,27 +6873,26 @@ class MTypeBarrier
         return AliasSet::None();
     }
     virtual bool neverHoist() const {
         return resultTypeSet()->empty();
     }
 };
 
 // Like MTypeBarrier, guard that the value is in the given type set. This is
-// used after some VM calls (like GetElement) to avoid the slower calls to
-// TypeScript::Monitor inside these stubs.
+// used before property writes to ensure the value being written is represented
+// in the property types for the object.
 class MMonitorTypes : public MUnaryInstruction
 {
     const types::StackTypeSet *typeSet_;
 
     MMonitorTypes(MDefinition *def, const types::StackTypeSet *types)
       : MUnaryInstruction(def),
         typeSet_(types)
     {
-        setResultType(MIRType_Value);
         setGuard();
         JS_ASSERT(!types->unknown());
     }
 
   public:
     INSTRUCTION_HEADER(MonitorTypes)
 
     static MMonitorTypes *New(MDefinition *def, const types::StackTypeSet *types) {
--- a/js/src/ion/shared/Lowering-shared-inl.h
+++ b/js/src/ion/shared/Lowering-shared-inl.h
@@ -396,19 +396,16 @@ LIRGeneratorShared::add(T *ins, MInstruc
 #ifdef JS_NUNBOX32
 // Returns the virtual register of a js::Value-defining instruction. This is
 // abstracted because MBox is a special value-returning instruction that
 // redefines its input payload if its input is not constant. Therefore, it is
 // illegal to request a box's payload by adding VREG_DATA_OFFSET to its raw id.
 static inline uint32_t
 VirtualRegisterOfPayload(MDefinition *mir)
 {
-    // Type barriers may have box inputs, and pass through their input's vreg.
-    while (mir->isTypeBarrier())
-        mir = mir->getOperand(0);
     if (mir->isBox()) {
         MDefinition *inner = mir->toBox()->getOperand(0);
         if (!inner->isConstant() && inner->type() != MIRType_Double)
             return inner->virtualRegister();
     }
     return mir->virtualRegister() + VREG_DATA_OFFSET;
 }