Compile JSOP_IN (bug 594111, r=dmandelin).

js/src/methodjit/Compiler.cpp

@@ -1321,6 +1321,14 @@ mjit::Compiler::generateMethod()
             frame.pop();
           END_CASE(JSOP_THROW)
 
+          BEGIN_CASE(JSOP_IN)
+            prepareStubCall(Uses(2));
+            stubCall(stubs::In);
+            frame.popn(2);
+            frame.takeReg(Registers::ReturnReg);
+            frame.pushTypedPayload(JSVAL_TYPE_BOOLEAN, Registers::ReturnReg);
+          END_CASE(JSOP_IN)
+
           BEGIN_CASE(JSOP_INSTANCEOF)
             jsop_instanceof();
           END_CASE(JSOP_INSTANCEOF)

js/src/methodjit/StubCalls.cpp

@@ -2762,6 +2762,34 @@ stubs::DefVar(VMFrame &f, JSAtom *atom)
     obj2->dropProperty(cx, prop);
 }
 
+JSBool JS_FASTCALL
+stubs::In(VMFrame &f)
+{
+    JSContext *cx = f.cx;
+
+    const Value &rref = f.regs.sp[-1];
+    if (!rref.isObject()) {
+        js_ReportValueError(cx, JSMSG_IN_NOT_OBJECT, -1, rref, NULL);
+        THROWV(JS_FALSE);
+    }
+
+    JSObject *obj = &rref.toObject();
+    jsid id;
+    if (!FetchElementId(f, obj, f.regs.sp[-2], id, &f.regs.sp[-2]))
+        THROWV(JS_FALSE);
+
+    JSObject *obj2;
+    JSProperty *prop;
+    if (!obj->lookupProperty(cx, id, &obj2, &prop))
+        THROWV(JS_FALSE);
+
+    JSBool cond = !!prop;
+    if (prop)
+        obj2->dropProperty(cx, prop);
+
+    return cond;
+}
+
 template void JS_FASTCALL stubs::DelElem<true>(VMFrame &f);
 template void JS_FASTCALL stubs::DelElem<false>(VMFrame &f);
 

js/src/methodjit/StubCalls.h

@@ -148,6 +148,7 @@ void JS_FASTCALL CallProp(VMFrame &f, JSAtom *atom);
 template <JSBool strict> void JS_FASTCALL DelProp(VMFrame &f, JSAtom *atom);
 template <JSBool strict> void JS_FASTCALL DelElem(VMFrame &f);
 void JS_FASTCALL DelName(VMFrame &f, JSAtom *atom);
+JSBool JS_FASTCALL In(VMFrame &f);
 
 void JS_FASTCALL DefVar(VMFrame &f, JSAtom *atom);
 template<JSBool strict> void JS_FASTCALL DefFun(VMFrame &f, JSFunction *fun);