Backed out changeset 1f47ae47ceac (bug 1546383) for Spidermonkey failures in js\src\jit-test\tests\cacheir\getter-primitive-value.js. CLOSED TREE
authorDorel Luca <dluca@mozilla.com>
Tue, 07 May 2019 00:56:51 +0300
changeset 531604 f776e9e5e817c9f1acd0451e915042089e80ce14
parent 531603 cf7b6547cfb26608ba79093ed78f85a56dfbfd56
child 531605 39077226dac335e743f7465fb91349d76ded1922
push id11265
push userffxbld-merge
push dateMon, 13 May 2019 10:53:39 +0000
treeherdermozilla-beta@77e0fe8dbdd3 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1546383
milestone68.0a1
backs out1f47ae47ceacd9bb1df12c3dd8987b93bd44f608
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backed out changeset 1f47ae47ceac (bug 1546383) for Spidermonkey failures in js\src\jit-test\tests\cacheir\getter-primitive-value.js. CLOSED TREE
js/src/jit-test/tests/cacheir/getter-primitive-value.js
js/src/jit/BaselineCacheIRCompiler.cpp
js/src/jit/CacheIR.cpp
js/src/jit/CacheIR.h
js/src/jit/IonCacheIRCompiler.cpp
js/src/jit/VMFunctionList-inl.h
js/src/jit/VMFunctions.cpp
js/src/jit/VMFunctions.h
deleted file mode 100644
--- a/js/src/jit-test/tests/cacheir/getter-primitive-value.js
+++ /dev/null
@@ -1,116 +0,0 @@
-function testNativeGetter() {
-    function test() {
-        var xs = [Symbol("a"), Symbol("b")];
-        var ys = ["a", "b"];
-
-        for (var i = 0; i < 100; ++i) {
-            var r = xs[i & 1].description;
-            assertEq(r, ys[i & 1]);
-        }
-    }
-    for (var i = 0; i < 2; ++i) test();
-}
-testNativeGetter();
-
-function testScriptedGetter() {
-    Object.defineProperty(Symbol.prototype, "desc", {
-        get() {
-            "use strict";
-            assertEq(typeof this, "symbol");
-            return this.description;
-        }
-    });
-
-    function test() {
-        var xs = [Symbol("a"), Symbol("b")];
-        var ys = ["a", "b"];
-
-        for (var i = 0; i < 100; ++i) {
-            var r = xs[i & 1].desc;
-            assertEq(r, ys[i & 1]);
-        }
-    }
-    for (var i = 0; i < 2; ++i) test();
-}
-testScriptedGetter();
-
-function testScriptedGetterNonStrict() {
-    Object.defineProperty(Symbol.prototype, "desc_nonstrict", {
-        get() {
-            assertEq(typeof this, "object");
-            return this.description;
-        }
-    });
-
-    function test() {
-        var xs = [Symbol("a"), Symbol("b")];
-        var ys = ["a", "b"];
-
-        for (var i = 0; i < 100; ++i) {
-            var r = xs[i & 1].desc_nonstrict;
-            assertEq(r, ys[i & 1]);
-        }
-    }
-    for (var i = 0; i < 2; ++i) test();
-}
-testScriptedGetterNonStrict();
-
-function testNativeGetterPrototype() {
-    Object.defineProperty(Object.prototype, "description_proto",
-        Object.getOwnPropertyDescriptor(Symbol.prototype, "description"));
-
-    function test() {
-        var xs = [Symbol("a"), Symbol("b")];
-        var ys = ["a", "b"];
-
-        for (var i = 0; i < 100; ++i) {
-            var r = xs[i & 1].description_proto;
-            assertEq(r, ys[i & 1]);
-        }
-    }
-    for (var i = 0; i < 2; ++i) test();
-}
-testNativeGetterPrototype();
-
-function testScriptedGetterPrototype() {
-    Object.defineProperty(Object.prototype, "desc_proto", {
-        get() {
-            "use strict";
-            assertEq(typeof this, "symbol");
-            return this.description;
-        }
-    });
-
-    function test() {
-        var xs = [Symbol("a"), Symbol("b")];
-        var ys = ["a", "b"];
-
-        for (var i = 0; i < 100; ++i) {
-            var r = xs[i & 1].desc_proto;
-            assertEq(r, ys[i & 1]);
-        }
-    }
-    for (var i = 0; i < 2; ++i) test();
-}
-testScriptedGetterPrototype();
-
-function testScriptedGetterNonStrictPrototype() {
-    Object.defineProperty(Object.prototype, "desc_nonstrict_proto", {
-        get() {
-            assertEq(typeof this, "object");
-            return this.description;
-        }
-    });
-
-    function test() {
-        var xs = [Symbol("a"), Symbol("b")];
-        var ys = ["a", "b"];
-
-        for (var i = 0; i < 100; ++i) {
-            var r = xs[i & 1].desc_nonstrict_proto;
-            assertEq(r, ys[i & 1]);
-        }
-    }
-    for (var i = 0; i < 2; ++i) test();
-}
-testScriptedGetterNonStrictPrototype();
--- a/js/src/jit/BaselineCacheIRCompiler.cpp
+++ b/js/src/jit/BaselineCacheIRCompiler.cpp
@@ -86,23 +86,16 @@ class MOZ_RAII BaselineCacheIRCompiler :
                         Register scratch2, bool isJitCall);
   void createThis(Register argcReg, Register calleeReg, Register scratch,
                   CallFlags flags);
   void updateReturnValue();
 
   enum class NativeCallType { Native, ClassHook };
   bool emitCallNativeShared(NativeCallType callType);
 
-  MOZ_MUST_USE bool emitCallScriptedGetterResultShared(
-      TypedOrValueRegister receiver);
-
-  template <typename T, typename CallVM>
-  MOZ_MUST_USE bool emitCallNativeGetterResultShared(T receiver,
-                                                     const CallVM& emitCallVM);
-
  public:
   friend class AutoStubFrame;
 
   BaselineCacheIRCompiler(JSContext* cx, const CacheIRWriter& writer,
                           uint32_t stubDataOffset,
                           BaselineCacheIRStubKind stubKind)
       : CacheIRCompiler(cx, writer, stubDataOffset, Mode::Baseline,
                         StubFieldPolicy::Address),
@@ -555,18 +548,19 @@ bool BaselineCacheIRCompiler::emitGuardH
   masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, ObjectHasGetterSetterPure));
   masm.mov(ReturnReg, scratch1);
   masm.PopRegsInMask(volatileRegs);
 
   masm.branchIfFalseBool(scratch1, failure->label());
   return true;
 }
 
-bool BaselineCacheIRCompiler::emitCallScriptedGetterResultShared(
-    TypedOrValueRegister receiver) {
+bool BaselineCacheIRCompiler::emitCallScriptedGetterResult() {
+  JitSpew(JitSpew_Codegen, __FUNCTION__);
+  Register obj = allocator.useRegister(masm, reader.objOperandId());
   Address getterAddr(stubAddress(reader.stubOffset()));
   bool isSameRealm = reader.readBool();
 
   AutoScratchRegister code(allocator, masm);
   AutoScratchRegister callee(allocator, masm);
   AutoScratchRegister scratch(allocator, masm);
 
   // First, ensure our getter is non-lazy.
@@ -590,20 +584,20 @@ bool BaselineCacheIRCompiler::emitCallSc
   if (!isSameRealm) {
     masm.switchToObjectRealm(callee, scratch);
   }
 
   // Align the stack such that the JitFrameLayout is aligned on
   // JitStackAlignment.
   masm.alignJitStackBasedOnNArgs(0);
 
-  // Getter is called with 0 arguments, just |receiver| as thisv.
+  // Getter is called with 0 arguments, just |obj| as thisv.
   // Note that we use Push, not push, so that callJit will align the stack
   // properly on ARM.
-  masm.Push(receiver);
+  masm.Push(TypedOrValueRegister(MIRType::Object, AnyRegister(obj)));
 
   EmitBaselineCreateStubFrameDescriptor(masm, scratch, JitFrameLayout::Size());
   masm.Push(Imm32(0));  // ActualArgc is 0
   masm.Push(callee);
   masm.Push(scratch);
 
   // Handle arguments underflow.
   Label noUnderflow;
@@ -623,77 +617,42 @@ bool BaselineCacheIRCompiler::emitCallSc
 
   if (!isSameRealm) {
     masm.switchToBaselineFrameRealm(R1.scratchReg());
   }
 
   return true;
 }
 
-bool BaselineCacheIRCompiler::emitCallScriptedGetterResult() {
+bool BaselineCacheIRCompiler::emitCallNativeGetterResult() {
   JitSpew(JitSpew_Codegen, __FUNCTION__);
   Register obj = allocator.useRegister(masm, reader.objOperandId());
-
-  return emitCallScriptedGetterResultShared(
-      TypedOrValueRegister(MIRType::Object, AnyRegister(obj)));
-}
-
-bool BaselineCacheIRCompiler::emitCallScriptedGetterByValueResult() {
-  JitSpew(JitSpew_Codegen, __FUNCTION__);
-  ValueOperand val = allocator.useValueRegister(masm, reader.valOperandId());
-
-  return emitCallScriptedGetterResultShared(val);
-}
-
-template <typename T, typename CallVM>
-bool BaselineCacheIRCompiler::emitCallNativeGetterResultShared(
-    T receiver, const CallVM& emitCallVM) {
   Address getterAddr(stubAddress(reader.stubOffset()));
 
   AutoScratchRegister scratch(allocator, masm);
 
   allocator.discardStack(masm);
 
   AutoStubFrame stubFrame(*this);
   stubFrame.enter(masm, scratch);
 
   // Load the callee in the scratch register.
   masm.loadPtr(getterAddr, scratch);
 
-  masm.Push(receiver);
+  masm.Push(obj);
   masm.Push(scratch);
 
-  emitCallVM();
+  using Fn =
+      bool (*)(JSContext*, HandleFunction, HandleObject, MutableHandleValue);
+  callVM<Fn, CallNativeGetter>(masm);
 
   stubFrame.leave(masm);
   return true;
 }
 
-bool BaselineCacheIRCompiler::emitCallNativeGetterResult() {
-  JitSpew(JitSpew_Codegen, __FUNCTION__);
-  Register obj = allocator.useRegister(masm, reader.objOperandId());
-
-  return emitCallNativeGetterResultShared(obj, [this]() {
-    using Fn =
-        bool (*)(JSContext*, HandleFunction, HandleObject, MutableHandleValue);
-    callVM<Fn, CallNativeGetter>(masm);
-  });
-}
-
-bool BaselineCacheIRCompiler::emitCallNativeGetterByValueResult() {
-  JitSpew(JitSpew_Codegen, __FUNCTION__);
-  ValueOperand val = allocator.useValueRegister(masm, reader.valOperandId());
-
-  return emitCallNativeGetterResultShared(val, [this]() {
-    using Fn =
-        bool (*)(JSContext*, HandleFunction, HandleValue, MutableHandleValue);
-    callVM<Fn, CallNativeGetterByValue>(masm);
-  });
-}
-
 bool BaselineCacheIRCompiler::emitCallProxyGetResult() {
   JitSpew(JitSpew_Codegen, __FUNCTION__);
   Register obj = allocator.useRegister(masm, reader.objOperandId());
   Address idAddr(stubAddress(reader.stubOffset()));
 
   AutoScratchRegister scratch(allocator, masm);
 
   allocator.discardStack(masm);
--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@@ -915,98 +915,59 @@ static void EmitCallGetterResultNoGuards
                                          JSObject* holder, Shape* shape,
                                          ObjOperandId receiverId) {
   switch (IsCacheableGetPropCall(obj, holder, shape)) {
     case CanAttachNativeGetter: {
       JSFunction* target = &shape->getterValue().toObject().as<JSFunction>();
       MOZ_ASSERT(target->isBuiltinNative());
       writer.callNativeGetterResult(receiverId, target);
       writer.typeMonitorResult();
-      break;
-    }
+    } break;
     case CanAttachScriptedGetter: {
       JSFunction* target = &shape->getterValue().toObject().as<JSFunction>();
       MOZ_ASSERT(target->hasJitEntry());
       writer.callScriptedGetterResult(receiverId, target);
       writer.typeMonitorResult();
-      break;
-    }
+    } break;
     default:
-      // CanAttachNativeGetProp guarantees that the getter is either a native or
-      // a scripted function.
       MOZ_ASSERT_UNREACHABLE("Can't attach getter");
       break;
   }
 }
 
-static void EmitCallGetterResultGuards(CacheIRWriter& writer, JSObject* obj,
-                                       JSObject* holder, Shape* shape,
-                                       ObjOperandId objId, ICState::Mode mode) {
+static void EmitCallGetterResult(CacheIRWriter& writer, JSObject* obj,
+                                 JSObject* holder, Shape* shape,
+                                 ObjOperandId objId, ObjOperandId receiverId,
+                                 ICState::Mode mode) {
   // Use the megamorphic guard if we're in megamorphic mode, except if |obj|
   // is a Window as GuardHasGetterSetter doesn't support this yet (Window may
   // require outerizing).
   if (mode == ICState::Mode::Specialized || IsWindow(obj)) {
     TestMatchingReceiver(writer, obj, objId);
 
     if (obj != holder) {
       GeneratePrototypeGuards(writer, obj, holder, objId);
 
       // Guard on the holder's shape.
       ObjOperandId holderId = writer.loadObject(holder);
       TestMatchingHolder(writer, holder, holderId);
     }
   } else {
     writer.guardHasGetterSetter(objId, shape);
   }
-}
-
-static void EmitCallGetterResult(CacheIRWriter& writer, JSObject* obj,
-                                 JSObject* holder, Shape* shape,
-                                 ObjOperandId objId, ObjOperandId receiverId,
-                                 ICState::Mode mode) {
-  EmitCallGetterResultGuards(writer, obj, holder, shape, objId, mode);
+
   EmitCallGetterResultNoGuards(writer, obj, holder, shape, receiverId);
 }
 
 static void EmitCallGetterResult(CacheIRWriter& writer, JSObject* obj,
                                  JSObject* holder, Shape* shape,
                                  ObjOperandId objId, ICState::Mode mode) {
   EmitCallGetterResult(writer, obj, holder, shape, objId, objId, mode);
 }
 
-static void EmitCallGetterByValueResult(CacheIRWriter& writer, JSObject* obj,
-                                        JSObject* holder, Shape* shape,
-                                        ObjOperandId objId,
-                                        ValOperandId receiverId,
-                                        ICState::Mode mode) {
-  EmitCallGetterResultGuards(writer, obj, holder, shape, objId, mode);
-
-  switch (IsCacheableGetPropCall(obj, holder, shape)) {
-    case CanAttachNativeGetter: {
-      JSFunction* target = &shape->getterValue().toObject().as<JSFunction>();
-      MOZ_ASSERT(target->isBuiltinNative());
-      writer.callNativeGetterByValueResult(receiverId, target);
-      writer.typeMonitorResult();
-      break;
-    }
-    case CanAttachScriptedGetter: {
-      JSFunction* target = &shape->getterValue().toObject().as<JSFunction>();
-      MOZ_ASSERT(target->hasJitEntry());
-      writer.callScriptedGetterByValueResult(receiverId, target);
-      writer.typeMonitorResult();
-      break;
-    }
-    default:
-      // CanAttachNativeGetProp guarantees that the getter is either a native or
-      // a scripted function.
-      MOZ_ASSERT_UNREACHABLE("Can't attach getter");
-      break;
-  }
-}
-
 void GetPropIRGenerator::attachMegamorphicNativeSlot(ObjOperandId objId,
                                                      jsid id,
                                                      bool handleMissing) {
   MOZ_ASSERT(mode_ == ICState::Mode::Megamorphic);
 
   // The stub handles the missing-properties case only if we're seeing one
   // now, to make sure Ion ICs correctly monitor the undefined type.
 
@@ -1884,69 +1845,43 @@ AttachDecision GetPropIRGenerator::tryAt
   if (!proto) {
     return AttachDecision::NoAction;
   }
 
   RootedShape shape(cx_);
   RootedNativeObject holder(cx_);
   NativeGetPropCacheability type = CanAttachNativeGetProp(
       cx_, proto, id, &holder, &shape, pc_, resultFlags_);
-  switch (type) {
-    case CanAttachNone:
-      return AttachDecision::NoAction;
-    case CanAttachTemporarilyUnoptimizable:
-      return AttachDecision::TemporarilyUnoptimizable;
-    case CanAttachReadSlot: {
-      if (holder) {
-        // Instantiate this property, for use during Ion compilation.
-        if (IsIonEnabled(cx_)) {
-          EnsureTrackPropertyTypes(cx_, holder, id);
-        }
-      }
-
-      if (val_.isNumber()) {
-        writer.guardIsNumber(valId);
-      } else {
-        writer.guardType(valId, val_.type());
-      }
-      maybeEmitIdGuard(id);
-
-      ObjOperandId protoId = writer.loadObject(proto);
-      EmitReadSlotResult(writer, proto, holder, shape, protoId);
-      EmitReadSlotReturn(writer, proto, holder, shape);
-
-      trackAttached("PrimitiveSlot");
-      return AttachDecision::Attach;
+  if (type == CanAttachTemporarilyUnoptimizable) {
+    return AttachDecision::TemporarilyUnoptimizable;
+  }
+  if (type != CanAttachReadSlot) {
+    return AttachDecision::NoAction;
+  }
+
+  if (holder) {
+    // Instantiate this property, for use during Ion compilation.
+    if (IsIonEnabled(cx_)) {
+      EnsureTrackPropertyTypes(cx_, holder, id);
     }
-    case CanAttachScriptedGetter:
-    case CanAttachNativeGetter: {
-      MOZ_ASSERT(!idempotent());
-
-      // The primitive stubs don't currently support |super| access.
-      if (isSuper()) {
-        return AttachDecision::NoAction;
-      }
-
-      if (val_.isNumber()) {
-        writer.guardIsNumber(valId);
-      } else {
-        writer.guardType(valId, val_.type());
-      }
-      maybeEmitIdGuard(id);
-
-      ObjOperandId protoId = writer.loadObject(proto);
-      EmitCallGetterByValueResult(writer, proto, holder, shape, protoId, valId,
-                                  mode_);
-
-      trackAttached("PrimitiveGetter");
-      return AttachDecision::Attach;
-    }
-  }
-
-  MOZ_CRASH("Bad NativeGetPropCacheability");
+  }
+
+  if (val_.isNumber()) {
+    writer.guardIsNumber(valId);
+  } else {
+    writer.guardType(valId, val_.type());
+  }
+  maybeEmitIdGuard(id);
+
+  ObjOperandId protoId = writer.loadObject(proto);
+  EmitReadSlotResult(writer, proto, holder, shape, protoId);
+  EmitReadSlotReturn(writer, proto, holder, shape);
+
+  trackAttached("Primitive");
+  return AttachDecision::Attach;
 }
 
 AttachDecision GetPropIRGenerator::tryAttachStringLength(ValOperandId valId,
                                                          HandleId id) {
   if (!val_.isString() || !JSID_IS_ATOM(id, cx_->names().length)) {
     return AttachDecision::NoAction;
   }
 
--- a/js/src/jit/CacheIR.h
+++ b/js/src/jit/CacheIR.h
@@ -321,19 +321,17 @@ extern const uint32_t ArgLengths[];
   _(LoadStringLengthResult, Id)                                                \
   _(LoadFrameCalleeResult, None)                                               \
   _(LoadFrameNumActualArgsResult, None)                                        \
   _(LoadFrameArgumentResult, Id)                                               \
   _(LoadEnvironmentFixedSlotResult, Id, Field)                                 \
   _(LoadEnvironmentDynamicSlotResult, Id, Field)                               \
   _(LoadObjectResult, Id)                                                      \
   _(CallScriptedGetterResult, Id, Field, Byte)                                 \
-  _(CallScriptedGetterByValueResult, Id, Field, Byte)                          \
   _(CallNativeGetterResult, Id, Field)                                         \
-  _(CallNativeGetterByValueResult, Id, Field)                                  \
   _(CallProxyGetResult, Id, Field)                                             \
   _(CallProxyGetByValueResult, Id, Id)                                         \
   _(CallProxyHasPropResult, Id, Id, Byte)                                      \
   _(CallObjectHasSparseElementResult, Id, Id)                                  \
   _(CallNativeGetElementResult, Id, Id)                                        \
   _(LoadUndefinedResult, None)                                                 \
   _(LoadBooleanResult, Byte)                                                   \
   _(LoadStringResult, Field)                                                   \
@@ -1636,29 +1634,20 @@ class MOZ_RAII CacheIRWriter : public JS
     writeOpWithOperandId(CacheOp::LoadStringCharResult, str);
     writeOperandId(index);
   }
   void callScriptedGetterResult(ObjOperandId obj, JSFunction* getter) {
     writeOpWithOperandId(CacheOp::CallScriptedGetterResult, obj);
     addStubField(uintptr_t(getter), StubField::Type::JSObject);
     buffer_.writeByte(cx_->realm() == getter->realm());
   }
-  void callScriptedGetterByValueResult(ValOperandId obj, JSFunction* getter) {
-    writeOpWithOperandId(CacheOp::CallScriptedGetterByValueResult, obj);
-    addStubField(uintptr_t(getter), StubField::Type::JSObject);
-    buffer_.writeByte(cx_->realm() == getter->realm());
-  }
   void callNativeGetterResult(ObjOperandId obj, JSFunction* getter) {
     writeOpWithOperandId(CacheOp::CallNativeGetterResult, obj);
     addStubField(uintptr_t(getter), StubField::Type::JSObject);
   }
-  void callNativeGetterByValueResult(ValOperandId obj, JSFunction* getter) {
-    writeOpWithOperandId(CacheOp::CallNativeGetterByValueResult, obj);
-    addStubField(uintptr_t(getter), StubField::Type::JSObject);
-  }
   void callProxyGetResult(ObjOperandId obj, jsid id) {
     writeOpWithOperandId(CacheOp::CallProxyGetResult, obj);
     addStubField(uintptr_t(JSID_BITS(id)), StubField::Type::Id);
   }
   void callProxyGetByValueResult(ObjOperandId obj, ValOperandId idVal) {
     writeOpWithOperandId(CacheOp::CallProxyGetByValueResult, obj);
     writeOperandId(idVal);
   }
--- a/js/src/jit/IonCacheIRCompiler.cpp
+++ b/js/src/jit/IonCacheIRCompiler.cpp
@@ -108,21 +108,16 @@ class MOZ_RAII IonCacheIRCompiler : publ
 
   template <typename Fn, Fn fn>
   void callVM(MacroAssembler& masm) {
     VMFunctionId id = VMFunctionToId<Fn, fn>::id;
     callVMInternal(masm, id);
   }
 
   MOZ_MUST_USE bool emitAddAndStoreSlotShared(CacheOp op);
-  MOZ_MUST_USE bool emitCallScriptedGetterResultShared(
-      TypedOrValueRegister receiver, TypedOrValueRegister output);
-  MOZ_MUST_USE bool emitCallNativeGetterResultShared(
-      TypedOrValueRegister receiver, TypedOrValueRegister output,
-      AutoSaveLiveRegisters& save);
 
   bool needsPostBarrier() const {
     return ic_->asSetPropertyIC()->needsPostBarrier();
   }
 
   void pushStubCodePointer() {
     stubJitCodeOffset_.emplace(masm.PushWithPatch(ImmPtr((void*)-1)));
   }
@@ -925,18 +920,22 @@ bool IonCacheIRCompiler::emitGuardHasGet
   masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, ObjectHasGetterSetterPure));
   masm.mov(ReturnReg, scratch1);
   masm.PopRegsInMask(volatileRegs);
 
   masm.branchIfFalseBool(scratch1, failure->label());
   return true;
 }
 
-bool IonCacheIRCompiler::emitCallScriptedGetterResultShared(
-    TypedOrValueRegister receiver, TypedOrValueRegister output) {
+bool IonCacheIRCompiler::emitCallScriptedGetterResult() {
+  JitSpew(JitSpew_Codegen, __FUNCTION__);
+  AutoSaveLiveRegisters save(*this);
+  AutoOutputRegister output(*this);
+
+  Register obj = allocator.useRegister(masm, reader.objOperandId());
   JSFunction* target = &objectStubField(reader.stubOffset())->as<JSFunction>();
   AutoScratchRegister scratch(allocator, masm);
 
   bool isSameRealm = reader.readBool();
   MOZ_ASSERT(isSameRealm == (cx_->realm() == target->realm()));
 
   allocator.discardStack(masm);
 
@@ -957,17 +956,17 @@ bool IonCacheIRCompiler::emitCallScripte
       ComputeByteAlignment(masm.framePushed() + argSize, JitStackAlignment);
   MOZ_ASSERT(padding % sizeof(uintptr_t) == 0);
   MOZ_ASSERT(padding < JitStackAlignment);
   masm.reserveStack(padding);
 
   for (size_t i = 0; i < target->nargs(); i++) {
     masm.Push(UndefinedValue());
   }
-  masm.Push(receiver);
+  masm.Push(TypedOrValueRegister(MIRType::Object, AnyRegister(obj)));
 
   if (!isSameRealm) {
     masm.switchToRealm(target->realm(), scratch);
   }
 
   masm.movePtr(ImmGCPtr(target), scratch);
 
   descriptor = MakeFrameDescriptor(argSize + padding, FrameType::IonICCall,
@@ -993,58 +992,40 @@ bool IonCacheIRCompiler::emitCallScripte
     masm.switchToRealm(cx_->realm(), ReturnReg);
   }
 
   masm.storeCallResultValue(output);
   masm.freeStack(masm.framePushed() - framePushedBefore);
   return true;
 }
 
-bool IonCacheIRCompiler::emitCallScriptedGetterResult() {
+bool IonCacheIRCompiler::emitCallNativeGetterResult() {
   JitSpew(JitSpew_Codegen, __FUNCTION__);
   AutoSaveLiveRegisters save(*this);
   AutoOutputRegister output(*this);
 
   Register obj = allocator.useRegister(masm, reader.objOperandId());
-
-  return emitCallScriptedGetterResultShared(
-      TypedOrValueRegister(MIRType::Object, AnyRegister(obj)), output);
-}
-
-bool IonCacheIRCompiler::emitCallScriptedGetterByValueResult() {
-  JitSpew(JitSpew_Codegen, __FUNCTION__);
-  AutoSaveLiveRegisters save(*this);
-  AutoOutputRegister output(*this);
-
-  ValueOperand val = allocator.useValueRegister(masm, reader.valOperandId());
-
-  return emitCallScriptedGetterResultShared(val, output);
-}
-
-bool IonCacheIRCompiler::emitCallNativeGetterResultShared(
-    TypedOrValueRegister receiver, TypedOrValueRegister output,
-    AutoSaveLiveRegisters& save) {
   JSFunction* target = &objectStubField(reader.stubOffset())->as<JSFunction>();
   MOZ_ASSERT(target->isNative());
 
   AutoScratchRegister argJSContext(allocator, masm);
   AutoScratchRegister argUintN(allocator, masm);
   AutoScratchRegister argVp(allocator, masm);
   AutoScratchRegister scratch(allocator, masm);
 
   allocator.discardStack(masm);
 
   // Native functions have the signature:
   //  bool (*)(JSContext*, unsigned, Value* vp)
   // Where vp[0] is space for an outparam, vp[1] is |this|, and vp[2] onward
   // are the function arguments.
 
   // Construct vp array:
-  // Push receiver value for |this|
-  masm.Push(receiver);
+  // Push object value for |this|
+  masm.Push(TypedOrValueRegister(MIRType::Object, AnyRegister(obj)));
   // Push callee/outparam.
   masm.Push(ObjectValue(*target));
 
   // Preload arguments into registers.
   masm.loadJSContext(argJSContext);
   masm.move32(Imm32(0), argUintN);
   masm.moveStackPtrTo(argVp.get());
 
@@ -1085,37 +1066,16 @@ bool IonCacheIRCompiler::emitCallNativeG
   if (JitOptions.spectreJitToCxxCalls) {
     masm.speculationBarrier();
   }
 
   masm.adjustStack(IonOOLNativeExitFrameLayout::Size(0));
   return true;
 }
 
-bool IonCacheIRCompiler::emitCallNativeGetterResult() {
-  JitSpew(JitSpew_Codegen, __FUNCTION__);
-  AutoSaveLiveRegisters save(*this);
-  AutoOutputRegister output(*this);
-
-  Register obj = allocator.useRegister(masm, reader.objOperandId());
-
-  return emitCallNativeGetterResultShared(
-      TypedOrValueRegister(MIRType::Object, AnyRegister(obj)), output, save);
-}
-
-bool IonCacheIRCompiler::emitCallNativeGetterByValueResult() {
-  JitSpew(JitSpew_Codegen, __FUNCTION__);
-  AutoSaveLiveRegisters save(*this);
-  AutoOutputRegister output(*this);
-
-  ValueOperand val = allocator.useValueRegister(masm, reader.valOperandId());
-
-  return emitCallNativeGetterResultShared(val, output, save);
-}
-
 bool IonCacheIRCompiler::emitCallProxyGetResult() {
   JitSpew(JitSpew_Codegen, __FUNCTION__);
   AutoSaveLiveRegisters save(*this);
   AutoOutputRegister output(*this);
 
   Register obj = allocator.useRegister(masm, reader.objOperandId());
   jsid id = idStubField(reader.stubOffset());
 
--- a/js/src/jit/VMFunctionList-inl.h
+++ b/js/src/jit/VMFunctionList-inl.h
@@ -51,17 +51,16 @@ namespace jit {
   _(BitLsh, js::BitLsh)                                                        \
   _(BitNot, js::BitNot)                                                        \
   _(BitOr, js::BitOr)                                                          \
   _(BitRsh, js::BitRsh)                                                        \
   _(BitXor, js::BitXor)                                                        \
   _(BoxNonStrictThis, js::BoxNonStrictThis)                                    \
   _(BuiltinProtoOperation, js::BuiltinProtoOperation)                          \
   _(CallNativeGetter, js::jit::CallNativeGetter)                               \
-  _(CallNativeGetterByValue, js::jit::CallNativeGetterByValue)                 \
   _(CallNativeSetter, js::jit::CallNativeSetter)                               \
   _(CharCodeAt, js::jit::CharCodeAt)                                           \
   _(CheckClassHeritageOperation, js::CheckClassHeritageOperation)              \
   _(CheckGlobalOrEvalDeclarationConflicts,                                     \
     js::CheckGlobalOrEvalDeclarationConflicts)                                 \
   _(CheckIsCallable, js::jit::CheckIsCallable)                                 \
   _(CheckOverRecursed, js::jit::CheckOverRecursed)                             \
   _(CheckOverRecursedBaseline, js::jit::CheckOverRecursedBaseline)             \
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -1554,35 +1554,16 @@ bool CallNativeGetter(JSContext* cx, Han
   if (!natfun(cx, 0, vp.begin())) {
     return false;
   }
 
   result.set(vp[0]);
   return true;
 }
 
-bool CallNativeGetterByValue(JSContext* cx, HandleFunction callee,
-                             HandleValue receiver, MutableHandleValue result) {
-  AutoRealm ar(cx, callee);
-
-  MOZ_ASSERT(callee->isNative());
-  JSNative natfun = callee->native();
-
-  JS::AutoValueArray<2> vp(cx);
-  vp[0].setObject(*callee.get());
-  vp[1].set(receiver);
-
-  if (!natfun(cx, 0, vp.begin())) {
-    return false;
-  }
-
-  result.set(vp[0]);
-  return true;
-}
-
 bool CallNativeSetter(JSContext* cx, HandleFunction callee, HandleObject obj,
                       HandleValue rhs) {
   AutoRealm ar(cx, callee);
 
   MOZ_ASSERT(callee->isNative());
   JSNative natfun = callee->native();
 
   JS::AutoValueArray<3> vp(cx);
--- a/js/src/jit/VMFunctions.h
+++ b/js/src/jit/VMFunctions.h
@@ -1051,20 +1051,16 @@ MOZ_MUST_USE bool ThrowBadDerivedReturn(
 MOZ_MUST_USE bool ThrowObjectCoercible(JSContext* cx, HandleValue v);
 
 MOZ_MUST_USE bool BaselineGetFunctionThis(JSContext* cx, BaselineFrame* frame,
                                           MutableHandleValue res);
 
 MOZ_MUST_USE bool CallNativeGetter(JSContext* cx, HandleFunction callee,
                                    HandleObject obj, MutableHandleValue result);
 
-MOZ_MUST_USE bool CallNativeGetterByValue(JSContext* cx, HandleFunction callee,
-                                          HandleValue receiver,
-                                          MutableHandleValue result);
-
 MOZ_MUST_USE bool CallNativeSetter(JSContext* cx, HandleFunction callee,
                                    HandleObject obj, HandleValue rhs);
 
 MOZ_MUST_USE bool EqualStringsHelperPure(JSString* str1, JSString* str2);
 
 MOZ_MUST_USE bool CheckIsCallable(JSContext* cx, HandleValue v,
                                   CheckIsCallableKind kind);