From 27d6f52ec9edaefc8f423b30a3c4bb958f6bf339 Mon Sep 17 00:00:00 2001
From: "Nicolas B. Pierron" <nicolas.b.pierron@mozilla.com>
Date: Mon, 26 Jan 2015 12:22:54 +0100
Subject: [PATCH] Bug 1112156 - Add new bailout kinds for MSimdUnbox.
 r=bbouvier

---
 js/src/jit/BaselineBailouts.cpp |  2 ++
 js/src/jit/IonTypes.h           |  8 +++++
 js/src/jit/Snapshots.cpp        | 63 ++++++++++++++++-----------------
 3 files changed, 41 insertions(+), 32 deletions(-)

diff --git a/js/src/jit/BaselineBailouts.cpp b/js/src/jit/BaselineBailouts.cpp
index f5b29abd9e89..718d222999d8 100644
--- a/js/src/jit/BaselineBailouts.cpp
+++ b/js/src/jit/BaselineBailouts.cpp
@@ -1754,6 +1754,8 @@ jit::FinishBailoutToBaseline(BaselineBailoutInfo *bailoutInfo)
       case Bailout_NonObjectInput:
       case Bailout_NonStringInput:
       case Bailout_NonSymbolInput:
+      case Bailout_NonSimdInt32x4Input:
+      case Bailout_NonSimdFloat32x4Input:
       case Bailout_InitialState:
       case Bailout_Debugger:
         // Do nothing.
diff --git a/js/src/jit/IonTypes.h b/js/src/jit/IonTypes.h
index aa71c713b1f9..74c62749bc16 100644
--- a/js/src/jit/IonTypes.h
+++ b/js/src/jit/IonTypes.h
@@ -100,6 +100,10 @@ enum BailoutKind
     Bailout_NonStringInput,
     Bailout_NonSymbolInput,
 
+    // SIMD Unbox expects a given type, bails out if it doesn't match.
+    Bailout_NonSimdInt32x4Input,
+    Bailout_NonSimdFloat32x4Input,
+
     // For the initial snapshot when entering a function.
     Bailout_InitialState,
 
@@ -193,6 +197,10 @@ BailoutKindString(BailoutKind kind)
         return "Bailout_NonStringInput";
       case Bailout_NonSymbolInput:
         return "Bailout_NonSymbolInput";
+      case Bailout_NonSimdInt32x4Input:
+        return "Bailout_NonSimdInt32x4Input";
+      case Bailout_NonSimdFloat32x4Input:
+        return "Bailout_NonSimdFloat32x4Input";
       case Bailout_InitialState:
         return "Bailout_InitialState";
       case Bailout_Debugger:
diff --git a/js/src/jit/Snapshots.cpp b/js/src/jit/Snapshots.cpp
index 4cc97dc609f9..a368170d58fb 100644
--- a/js/src/jit/Snapshots.cpp
+++ b/js/src/jit/Snapshots.cpp
@@ -19,10 +19,38 @@
 using namespace js;
 using namespace js::jit;
 
+// Encodings:
+//   [ptr] A fixed-size pointer.
+//   [vwu] A variable-width unsigned integer.
+//   [vws] A variable-width signed integer.
+//    [u8] An 8-bit unsigned integer.
+//   [u8'] An 8-bit unsigned integer which is potentially extended with packed
+//         data.
+//   [u8"] Packed data which is stored and packed in the previous [u8'].
+//  [vwu*] A list of variable-width unsigned integers.
+//   [pld] Payload of Recover Value Allocation:
+//         PAYLOAD_NONE:
+//           There is no payload.
+//
+//         PAYLOAD_INDEX:
+//           [vwu] Index, such as the constant pool index.
+//
+//         PAYLOAD_STACK_OFFSET:
+//           [vws] Stack offset based on the base of the Ion frame.
+//
+//         PAYLOAD_GPR:
+//            [u8] Code of the general register.
+//
+//         PAYLOAD_FPU:
+//            [u8] Code of the FPU register.
+//
+//         PAYLOAD_PACKED_TAG:
+//           [u8"] Bits 5-7: JSValueType is encoded on the low bits of the Mode
+//                           of the RValueAllocation.
+//
 // Snapshot header:
 //
-//   [vwu] bits ((n+1)-31]: frame count
-//         bit n+1: resume after
+//   [vwu] bits ((n+1)-31]: recover instruction offset
 //         bits [0,n): bailout kind (n = SNAPSHOT_BAILOUTKIND_BITS)
 //
 // Snapshot body, repeated "frame count" times, from oldest frame to newest frame.
@@ -92,35 +120,6 @@ using namespace js::jit;
 //           Value with statically known type, which payload is stored at an
 //           offset on the stack.
 //
-// Encodings:
-//   [ptr] A fixed-size pointer.
-//   [vwu] A variable-width unsigned integer.
-//   [vws] A variable-width signed integer.
-//    [u8] An 8-bit unsigned integer.
-//   [u8'] An 8-bit unsigned integer which is potentially extended with packed
-//         data.
-//   [u8"] Packed data which is stored and packed in the previous [u8'].
-//  [vwu*] A list of variable-width unsigned integers.
-//   [pld] Payload of Recover Value Allocation:
-//         PAYLOAD_NONE:
-//           There is no payload.
-//
-//         PAYLOAD_INDEX:
-//           [vwu] Index, such as the constant pool index.
-//
-//         PAYLOAD_STACK_OFFSET:
-//           [vws] Stack offset based on the base of the Ion frame.
-//
-//         PAYLOAD_GPR:
-//            [u8] Code of the general register.
-//
-//         PAYLOAD_FPU:
-//            [u8] Code of the FPU register.
-//
-//         PAYLOAD_PACKED_TAG:
-//           [u8"] Bits 5-7: JSValueType is encoded on the low bits of the Mode
-//                           of the RValueAllocation.
-//
 
 const RValueAllocation::Layout &
 RValueAllocation::layoutFromMode(Mode mode)
@@ -498,7 +497,7 @@ SnapshotReader::SnapshotReader(const uint8_t *snapshots, uint32_t offset,
 
 // Details of snapshot header packing.
 static const uint32_t SNAPSHOT_BAILOUTKIND_SHIFT = 0;
-static const uint32_t SNAPSHOT_BAILOUTKIND_BITS = 5;
+static const uint32_t SNAPSHOT_BAILOUTKIND_BITS = 6;
 static const uint32_t SNAPSHOT_BAILOUTKIND_MASK = COMPUTE_MASK_(SNAPSHOT_BAILOUTKIND);
 
 static const uint32_t SNAPSHOT_ROFFSET_SHIFT = COMPUTE_SHIFT_AFTER_(SNAPSHOT_BAILOUTKIND);