Bug 1432168 - Make guardType(..., JSVAL_TYPE_DOUBLE) check for Double, and not Number. r=tcampbell

To make this change, replace calls to guardType that currently have DOUBLE as the value
with ones that use a new guardNumber, which tests for Numbers instead.

js/src/jit/CacheIR.cpp

@@ -4143,7 +4143,11 @@ TypeOfIRGenerator::tryAttachPrimitive(ValOperandId valId)
     if (!val_.isPrimitive())
         return false;
 
-    writer.guardType(valId, val_.isNumber() ? JSVAL_TYPE_DOUBLE : val_.extractNonDoubleType());
+    if (val_.isNumber())
+        writer.guardIsNumber(valId);
+    else
+        writer.guardType(valId,  val_.extractNonDoubleType());
+
     writer.loadStringResult(TypeName(js::TypeOfValue(val_), cx_->names()));
     writer.returnFromIC();
 

js/src/jit/CacheIR.h

@@ -169,6 +169,7 @@ extern const char* CacheKindNames[];
     _(GuardIsNullOrUndefined)             \
     _(GuardIsString)                      \
     _(GuardIsSymbol)                      \
+    _(GuardIsNumber)                      \
     _(GuardIsInt32Index)                  \
     _(GuardType)                          \
     _(GuardShape)                         \
@@ -526,6 +527,9 @@ class MOZ_RAII CacheIRWriter : public JS::CustomAutoRooter
         writeOperandId(res);
         return res;
     }
+    void guardIsNumber(ValOperandId val) {
+        writeOpWithOperandId(CacheOp::GuardIsNumber, val);
+    }
     void guardType(ValOperandId val, JSValueType type) {
         writeOpWithOperandId(CacheOp::GuardType, val);
         static_assert(sizeof(type) == sizeof(uint8_t), "JSValueType should fit in a byte");

js/src/jit/CacheIRCompiler.cpp

@@ -1206,6 +1206,25 @@ CacheIRCompiler::emitFailurePath(size_t index)
     return true;
 }
 
+bool
+CacheIRCompiler::emitGuardIsNumber()
+{
+    ValOperandId inputId = reader.valOperandId();
+    JSValueType knownType = allocator.knownType(inputId);
+
+    // Doubles and ints are numbers!
+    if (knownType == JSVAL_TYPE_DOUBLE || knownType == JSVAL_TYPE_INT32)
+        return true;
+
+    ValueOperand input = allocator.useValueRegister(masm, inputId);
+    FailurePath* failure;
+    if (!addFailurePath(&failure))
+        return false;
+
+    masm.branchTestNumber(Assembler::NotEqual, input, failure->label());
+    return true;
+}
+
 bool
 CacheIRCompiler::emitGuardIsObject()
 {
@@ -1372,7 +1391,7 @@ CacheIRCompiler::emitGuardType()
         masm.branchTestInt32(Assembler::NotEqual, input, failure->label());
         break;
       case JSVAL_TYPE_DOUBLE:
-        masm.branchTestNumber(Assembler::NotEqual, input, failure->label());
+        masm.branchTestDouble(Assembler::NotEqual, input, failure->label());
         break;
       case JSVAL_TYPE_BOOLEAN:
         masm.branchTestBoolean(Assembler::NotEqual, input, failure->label());

js/src/jit/CacheIRCompiler.h

@@ -20,6 +20,7 @@ namespace jit {
     _(GuardIsObjectOrNull)                \
     _(GuardIsString)                      \
     _(GuardIsSymbol)                      \
+    _(GuardIsNumber)                      \
     _(GuardIsInt32Index)                  \
     _(GuardType)                          \
     _(GuardClass)                         \