Bug 1674719 - Part 2: Transpile GuardIsExtensible. r=jandem

Differential Revision: https://phabricator.services.mozilla.com/D95490

js/src/jit/AliasAnalysis.cpp

@@ -162,6 +162,7 @@ static inline const MDefinition* GetObject(const MDefinition* ins) {
     case MDefinition::Opcode::FunctionLength:
     case MDefinition::Opcode::FunctionName:
     case MDefinition::Opcode::GuardArgumentsObjectNotOverriddenIterator:
+    case MDefinition::Opcode::GuardIsExtensible:
       object = ins->getOperand(0);
       break;
     case MDefinition::Opcode::GetPropertyCache:

js/src/jit/CacheIROps.yaml

@@ -360,7 +360,7 @@
 
 - name: GuardIsExtensible
   shared: true
-  transpile: false
+  transpile: true
   cost_estimate: 1
   args:
     obj: ObjId

js/src/jit/CodeGenerator.cpp

@@ -14772,6 +14772,15 @@ void CodeGenerator::visitGuardHasGetterSetter(LGuardHasGetterSetter* lir) {
   bailoutIfFalseBool(ReturnReg, lir->snapshot());
 }
 
+void CodeGenerator::visitGuardIsExtensible(LGuardIsExtensible* lir) {
+  Register object = ToRegister(lir->object());
+  Register temp = ToRegister(lir->temp());
+
+  Label bail;
+  masm.branchIfObjectNotExtensible(object, temp, &bail);
+  bailoutFrom(&bail, lir->snapshot());
+}
+
 template <size_t NumDefs>
 void CodeGenerator::emitIonToWasmCallBase(LIonToWasmCallBase<NumDefs>* lir) {
   wasm::JitCallStackArgVector stackArgs;

js/src/jit/Lowering.cpp

@@ -5489,6 +5489,16 @@ void LIRGenerator::visitGuardHasGetterSetter(MGuardHasGetterSetter* ins) {
   redefine(ins, object);
 }
 
+void LIRGenerator::visitGuardIsExtensible(MGuardIsExtensible* ins) {
+  MDefinition* object = ins->object();
+  MOZ_ASSERT(object->type() == MIRType::Object);
+
+  auto* guard = new (alloc()) LGuardIsExtensible(useRegister(object), temp());
+  assignSnapshot(guard, ins->bailoutKind());
+  add(guard, ins);
+  redefine(ins, object);
+}
+
 void LIRGenerator::visitConstant(MConstant* ins) {
   if (!IsFloatingPointType(ins->type()) && ins->canEmitAtUses()) {
     emitAtUses(ins);

js/src/jit/MIR.h

@@ -12502,6 +12502,30 @@ class MGuardHasGetterSetter : public MUnaryInstruction,
   }
 };
 
+// Guard the object is extensible.
+class MGuardIsExtensible : public MUnaryInstruction,
+                           public SingleObjectPolicy::Data {
+  explicit MGuardIsExtensible(MDefinition* object)
+      : MUnaryInstruction(classOpcode, object) {
+    setResultType(MIRType::Object);
+    setMovable();
+    setGuard();
+  }
+
+ public:
+  INSTRUCTION_HEADER(GuardIsExtensible)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, object))
+
+  AliasSet getAliasSet() const override {
+    return AliasSet::Load(AliasSet::ObjectFields);
+  }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+};
+
 // Flips the input's sign bit, independently of the rest of the number's
 // payload. Note this is different from multiplying by minus-one, which has
 // side-effects for e.g. NaNs.

js/src/jit/WarpCacheIRTranspiler.cpp

@@ -1112,6 +1112,15 @@ bool WarpCacheIRTranspiler::emitGuardIsUndefined(ValOperandId inputId) {
   return true;
 }
 
+bool WarpCacheIRTranspiler::emitGuardIsExtensible(ObjOperandId objId) {
+  MDefinition* obj = getOperand(objId);
+
+  auto* ins = MGuardIsExtensible::New(alloc(), obj);
+  add(ins);
+  setOperand(objId, ins);
+  return true;
+}
+
 bool WarpCacheIRTranspiler::emitGuardTagNotEqual(ValueTagOperandId lhsId,
                                                  ValueTagOperandId rhsId) {
   MDefinition* lhs = getOperand(lhsId);

js/src/jit/shared/LIR-shared.h

@@ -8284,6 +8284,20 @@ class LGuardHasGetterSetter : public LCallInstructionHelper<0, 1, 2> {
   MGuardHasGetterSetter* mir() const { return mir_->toGuardHasGetterSetter(); }
 };
 
+class LGuardIsExtensible : public LInstructionHelper<0, 1, 1> {
+ public:
+  LIR_HEADER(GuardIsExtensible)
+
+  LGuardIsExtensible(const LAllocation& object, const LDefinition& temp)
+      : LInstructionHelper(classOpcode) {
+    setOperand(0, object);
+    setTemp(0, temp);
+  }
+
+  const LAllocation* object() { return getOperand(0); }
+  const LDefinition* temp() { return getTemp(0); }
+};
+
 template <size_t NumDefs>
 class LIonToWasmCallBase : public LVariadicInstruction<NumDefs, 2> {
   using Base = LVariadicInstruction<NumDefs, 2>;