Bug 1701787: Remove LoadNewObjectFromTemplateResult r=jandem

Differential Revision: https://phabricator.services.mozilla.com/D110434

js/src/jit/CacheIR.cpp

@@ -11030,36 +11030,10 @@ AttachDecision NewObjectIRGenerator::tryAttachPlainObject() {
   return AttachDecision::Attach;
 }
 
-AttachDecision NewObjectIRGenerator::tryAttachTemplateObject() {
-  if (templateObject_->as<NativeObject>().hasDynamicSlots()) {
-    return AttachDecision::NoAction;
-  }
-
-  // Stub doesn't support metadata builder
-  if (cx_->realm()->hasAllocationMetadataBuilder()) {
-    return AttachDecision::NoAction;
-  }
-
-  writer.guardNoAllocationMetadataBuilder();
-
-  // Bake in a monotonically increasing number to ensure we differentiate
-  // between different baseline stubs that otherwise might share stub code.
-  uint64_t id = cx_->runtime()->jitRuntime()->nextDisambiguationId();
-  uint32_t idHi = id >> 32;
-  uint32_t idLo = id & UINT32_MAX;
-  writer.loadNewObjectFromTemplateResult(templateObject_, idHi, idLo);
-
-  writer.returnFromIC();
-
-  trackAttached("NewObjectWithTemplate");
-  return AttachDecision::Attach;
-}
-
 AttachDecision NewObjectIRGenerator::tryAttachStub() {
   AutoAssertNoPendingException aanpe(cx_);
 
   TRY_ATTACH(tryAttachPlainObject());
-  TRY_ATTACH(tryAttachTemplateObject());
 
   trackAttached(IRGenerator::NotAttached);
   return AttachDecision::NoAction;

js/src/jit/CacheIR.h

@@ -1921,7 +1921,6 @@ class MOZ_RAII NewObjectIRGenerator : public IRGenerator {
 
   AttachDecision tryAttachStub();
   AttachDecision tryAttachPlainObject();
-  AttachDecision tryAttachTemplateObject();
 };
 
 // Retrieve Xray JIT info set by the embedder.

js/src/jit/CacheIRCompiler.cpp

@@ -6014,26 +6014,6 @@ bool CacheIRCompiler::emitLoadValueTruthyResult(ValOperandId inputId) {
   return true;
 }
 
-bool CacheIRCompiler::emitLoadNewObjectFromTemplateResult(
-    uint32_t templateObjectOffset, uint32_t, uint32_t) {
-  JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
-  AutoOutputRegister output(*this);
-  AutoScratchRegister obj(allocator, masm);
-  AutoScratchRegisterMaybeOutput scratch(allocator, masm, output);
-
-  TemplateObject templateObj(objectStubFieldUnchecked(templateObjectOffset));
-
-  FailurePath* failure;
-  if (!addFailurePath(&failure)) {
-    return false;
-  }
-
-  masm.createGCObject(obj, scratch, templateObj, gc::DefaultHeap,
-                      failure->label());
-  masm.tagValue(JSVAL_TYPE_OBJECT, obj, output.valueReg());
-  return true;
-}
-
 bool CacheIRCompiler::emitNewPlainObjectResult(uint32_t numFixedSlots,
                                                uint32_t numDynamicSlots,
                                                gc::AllocKind allocKind,

js/src/jit/CacheIRCompiler.h

@@ -857,14 +857,6 @@ class MOZ_RAII CacheIRCompiler {
     MOZ_ASSERT(stubFieldPolicy_ == StubFieldPolicy::Constant);
     return (JSObject*)readStubWord(offset, StubField::Type::JSObject);
   }
-  // This accessor is for cases where the stubField policy is
-  // being respected through other means, so we don't check the
-  // policy here. (see LoadNewObjectFromTemplateResult)
-  JSObject* objectStubFieldUnchecked(uint32_t offset) {
-    return (JSObject*)writer_
-        .readStubFieldForIon(offset, StubField::Type::JSObject)
-        .asWord();
-  }
   JSString* stringStubField(uint32_t offset) {
     MOZ_ASSERT(stubFieldPolicy_ == StubFieldPolicy::Constant);
     return (JSString*)readStubWord(offset, StubField::Type::String);

js/src/jit/CacheIROps.yaml

@@ -2440,15 +2440,6 @@
   args:
     val: ValueField
 
-- name: LoadNewObjectFromTemplateResult
-  shared: true
-  transpile: false
-  cost_estimate: 4
-  args:
-    templateObject: ObjectField
-    disambiguationIdHi: UInt32Imm
-    disambiguationIdLo: UInt32Imm
-
 - name: NewPlainObjectResult
   shared: true
   transpile: false

js/src/jit/JitRuntime.h

@@ -229,9 +229,6 @@ class JitRuntime {
   MainThreadData<IonCompileTaskList> ionLazyLinkList_;
   MainThreadData<size_t> ionLazyLinkListSize_{0};
 
-  // Counter used to help dismbiguate stubs in CacheIR
-  MainThreadData<uint64_t> disambiguationId_{0};
-
 #ifdef DEBUG
   // Flag that can be set from JIT code to indicate it's invalid to call
   // arbitrary JS code in a particular region. This is checked in RunScript.
@@ -443,8 +440,6 @@ class JitRuntime {
 
   void ionLazyLinkListRemove(JSRuntime* rt, js::jit::IonCompileTask* task);
   void ionLazyLinkListAdd(JSRuntime* rt, js::jit::IonCompileTask* task);
-
-  uint64_t nextDisambiguationId() { return disambiguationId_++; }
 };
 
 }  // namespace jit