Bug 1378189 - Part 9: Support JSOp::SuperCall in Ion. r=jandem

The note in `IonBuilder::inspectOpcode()` doesn't seem to apply anymore, probably
when we switched to CacheIR for call opcodes, the bailout issue noted there
doesn't matter anymore.

Inlining derived class constructors is enabled in the next part.

Differential Revision: https://phabricator.services.mozilla.com/D58784

--HG--
extra : moz-landing-system : lando

js/src/jit/BaselineIC.h

@@ -1646,12 +1646,18 @@ class ICSetProp_Fallback : public ICFallbackStub {
 // Call
 //      JSOp::Call
 //      JSOp::CallIgnoresRv
+//      JSOp::CallIter
 //      JSOp::FunApply
 //      JSOp::FunCall
 //      JSOp::New
+//      JSOp::SuperCall
+//      JSOp::Eval
+//      JSOp::StrictEval
 //      JSOp::SpreadCall
 //      JSOp::SpreadNew
+//      JSOp::SpreadSuperCall
 //      JSOp::SpreadEval
+//      JSOp::SpreadStrictEval
 
 class ICCall_Fallback : public ICMonitoredFallbackStub {
   friend class ICStubSpace;

js/src/jit/BaselineInspector.cpp

@@ -749,7 +749,7 @@ ObjectGroup* BaselineInspector::getTemplateObjectGroup(jsbytecode* pc) {
 }
 
 JSFunction* BaselineInspector::getSingleCallee(jsbytecode* pc) {
-  MOZ_ASSERT(JSOp(*pc) == JSOp::New);
+  MOZ_ASSERT(JSOp(*pc) == JSOp::New || JSOp(*pc) == JSOp::SuperCall);
 
   const ICEntry& entry = icEntryFromPC(pc);
   ICStub* stub = entry.firstStub();

js/src/jit/IonBuilder.cpp

@@ -459,6 +459,13 @@ IonBuilder::InliningDecision IonBuilder::canInlineTarget(JSFunction* target,
     return DontInline(inlineScript, "Not constructing class constructor");
   }
 
+  if (target->isDerivedClassConstructor()) {
+    // patchInlinedReturn() doesn't yet support derived class constructors, it
+    // must be patched to not use |callInfo.thisArg()| when the inlined target
+    // is a derived class constructor.
+    return DontInline(inlineScript, "Callee is a derived class constructor");
+  }
+
   if (!CanIonInlineScript(inlineScript)) {
     return DontInline(inlineScript, "Disabled Ion compilation");
   }
@@ -2131,6 +2138,7 @@ AbortReasonOr<Ok> IonBuilder::inspectOpcode(JSOp op, bool* restarted) {
     case JSOp::CallIgnoresRv:
     case JSOp::CallIter:
     case JSOp::New:
+    case JSOp::SuperCall:
       MOZ_TRY(jsop_call(GET_ARGC(pc),
                         JSOp(*pc) == JSOp::New || JSOp(*pc) == JSOp::SuperCall,
                         JSOp(*pc) == JSOp::CallIgnoresRv));
@@ -2480,6 +2488,7 @@ AbortReasonOr<Ok> IonBuilder::inspectOpcode(JSOp op, bool* restarted) {
 
     // Spread
     case JSOp::SpreadNew:
+    case JSOp::SpreadSuperCall:
     case JSOp::SpreadEval:
     case JSOp::StrictSpreadEval:
 
@@ -2492,13 +2501,6 @@ AbortReasonOr<Ok> IonBuilder::inspectOpcode(JSOp op, bool* restarted) {
     case JSOp::SetElemSuper:
     case JSOp::StrictSetPropSuper:
     case JSOp::StrictSetElemSuper:
-    // Most of the infrastructure for these exists in Ion, but needs review
-    // and testing before these are enabled. Once other opcodes that are used
-    // in derived classes are supported in Ion, this can be better validated
-    // with testcases. Pay special attention to bailout and other areas where
-    // JSOp::New has special handling.
-    case JSOp::SpreadSuperCall:
-    case JSOp::SuperCall:
 
     // Environments (bug 1366470)
     case JSOp::PushVarEnv:

js/src/jit/MIR.h

@@ -2632,7 +2632,7 @@ class MCall : public MVariadicInstruction, public CallPolicy::Data {
   // Original value of argc from the bytecode.
   uint32_t numActualArgs_;
 
-  // True if the call is for JSOp::New.
+  // True if the call is for JSOp::New or JSOp::SuperCall.
   bool construct_ : 1;
 
   // True if the caller does not use the return value.
@@ -3435,7 +3435,9 @@ class MAssertRange : public MUnaryInstruction, public NoTypePolicy::Data {
 };
 
 // Caller-side allocation of |this| for |new|:
-// Given a templateobject, construct |this| for JSOp::New
+// Given a templateobject, construct |this| for JSOp::New.
+// Not used for JSOp::SuperCall, because Baseline doesn't attach template
+// objects for super calls.
 class MCreateThisWithTemplate : public MUnaryInstruction,
                                 public NoTypePolicy::Data {
   gc::InitialHeap initialHeap_;
@@ -3470,7 +3472,7 @@ class MCreateThisWithTemplate : public MUnaryInstruction,
 };
 
 // Caller-side allocation of |this| for |new|:
-// Given a prototype operand, construct |this| for JSOp::New.
+// Given a prototype operand, construct |this| for JSOp::New or JSOp::SuperCall.
 class MCreateThisWithProto : public MTernaryInstruction,
                              public MixPolicy<ObjectPolicy<0>, ObjectPolicy<1>,
                                               ObjectPolicy<2>>::Data {