Bug 1765779 - Part 6: Support MIsObject in object scalar replacement. r=iain

This is the last remaining instruction which needs to be supported for scalar
replacement of iterator objects.

Differential Revision: https://phabricator.services.mozilla.com/D144295

js/src/jit/ScalarReplacement.cpp

@@ -336,6 +336,10 @@ static bool IsObjectEscaped(MDefinition* ins, MInstruction* newObject,
         break;
       }
 
+      // Doesn't escape the object.
+      case MDefinition::Opcode::IsObject:
+        break;
+
       // This instruction is a no-op used to verify that scalar replacement
       // is working as expected in jit-test.
       case MDefinition::Opcode::AssertRecoveredOnBailout:
@@ -403,6 +407,7 @@ class ObjectMemoryView : public MDefinitionVisitorDefaultNoop {
   void visitFunctionWithProto(MFunctionWithProto* ins);
   void visitPhi(MPhi* ins);
   void visitCompare(MCompare* ins);
+  void visitIsObject(MIsObject* ins);
 };
 
 /* static */ const char ObjectMemoryView::phaseName[] =
@@ -816,6 +821,22 @@ void ObjectMemoryView::visitCompare(MCompare* ins) {
   ins->block()->discard(ins);
 }
 
+void ObjectMemoryView::visitIsObject(MIsObject* ins) {
+  // Skip unrelated tests.
+  if (ins->input() != obj_) {
+    return;
+  }
+
+  auto* cst = MConstant::New(alloc_, BooleanValue(true));
+  ins->block()->insertBefore(ins, cst);
+
+  // Replace the test with a constant.
+  ins->replaceAllUsesWith(cst);
+
+  // Remove original instruction.
+  ins->block()->discard(ins);
+}
+
 static bool IndexOf(MDefinition* ins, int32_t* res) {
   MOZ_ASSERT(ins->isLoadElement() || ins->isStoreElement());
   MDefinition* indexDef = ins->getOperand(1);  // ins->index();