Bug 1000780 - Part 1: Bake in already-cloned intrinsic functions even if the callsite doesn't have type information. r=jandem

This means that self-hosted code can ensure that even codepaths that might not yet have been excercised have baked-in intrinsics by ensuring that the intrinsic has been cloned into the current compartment.

--HG--
extra : rebase_source : 192a9f2ce2f71fba241dd0c9e6386f877ac47fbe

js/src/jit/IonBuilder.cpp

@@ -8373,9 +8373,11 @@ IonBuilder::jsop_intrinsic(PropertyName* name)
 {
     TemporaryTypeSet* types = bytecodeTypes(pc);
 
-    // If we haven't executed this opcode yet, we need to get the intrinsic
-    // value and monitor the result.
-    if (types->empty()) {
+    Value vp = script()->global().maybeExistingIntrinsicValue(name);
+
+    // If the intrinsic value doesn't yet exist, we haven't executed this
+    // opcode yet, so we need to get it and monitor the result.
+    if (vp.isUndefined()) {
         MCallGetIntrinsicValue* ins = MCallGetIntrinsicValue::New(alloc(), name);
 
         current->add(ins);
@@ -8387,10 +8389,12 @@ IonBuilder::jsop_intrinsic(PropertyName* name)
         return pushTypeBarrier(ins, types, BarrierKind::TypeSet);
     }
 
+    if (types->empty())
+        types->addType(TypeSet::GetValueType(vp), alloc().lifoAlloc());
+
     // Bake in the intrinsic, guaranteed to exist because a non-empty typeset
     // means the intrinsic was successfully gotten in the VM call above.
     // Assert that TI agrees with us on the type.
-    Value vp = script()->global().existingIntrinsicValue(name);
     MOZ_ASSERT(types->hasType(TypeSet::GetValueType(vp)));
 
     pushConstant(vp);

js/src/vm/GlobalObject.h

@@ -579,18 +579,29 @@ class GlobalObject : public NativeObject
 
     static NativeObject* getIntrinsicsHolder(JSContext* cx, Handle<GlobalObject*> global);
 
-    Value existingIntrinsicValue(PropertyName* name) {
+    Value maybeExistingIntrinsicValue(PropertyName* name) {
         Value slot = getReservedSlot(INTRINSICS);
-        MOZ_ASSERT(slot.isObject(), "intrinsics holder must already exist");
+        // If we're in the self-hosting compartment itself, the
+        // intrinsics-holder isn't initialized at this point.
+        if (slot.isUndefined())
+            return UndefinedValue();
 
         NativeObject* holder = &slot.toObject().as<NativeObject>();
 
         Shape* shape = holder->lookupPure(name);
-        MOZ_ASSERT(shape, "intrinsic must already have been added to holder");
+        if (!shape)
+            return UndefinedValue();
 
         return holder->getSlot(shape->slot());
     }
 
+    Value existingIntrinsicValue(PropertyName* name) {
+        Value val = maybeExistingIntrinsicValue(name);
+        MOZ_ASSERT(!val.isUndefined(), "intrinsic must already have been added to holder");
+
+        return val;
+    }
+
     static bool
     maybeGetIntrinsicValue(JSContext* cx, Handle<GlobalObject*> global, Handle<PropertyName*> name,
                            MutableHandleValue vp)