Bug 1438727: [Part 2] Implement a subset of JSOP_SUB in CacheIR r=jandem

--HG--
extra : rebase_source : ef17b158715983ef2beedf787cd506678272464c

js/src/jit/BaselineIC.cpp

@@ -4923,6 +4923,7 @@ DoCacheIRBinaryArithFallback(JSContext* cx, BaselineFrame* frame, ICBinaryArith_
     // Ensure we're only generating for an enabled opcode.
     switch(op) {
       case JSOP_ADD:
+      case JSOP_SUB:
         break;
       default:
         return false; // Fallback to shared IC.

js/src/jit/CacheIR.cpp

@@ -5102,7 +5102,7 @@ BinaryArithIRGenerator::tryAttachStub()
 bool
 BinaryArithIRGenerator::tryAttachDouble()
 {
-    if (op_ != JSOP_ADD)
+    if (op_ != JSOP_ADD && op_ != JSOP_SUB)
         return false;
 
     if (!lhs_.isDouble() || !rhs_.isDouble() || !res_.isDouble())
@@ -5122,6 +5122,10 @@ BinaryArithIRGenerator::tryAttachDouble()
         writer.doubleAddResult(lhsId, rhsId);
         trackAttached("BinaryArith.Double.Add");
         break;
+      case JSOP_SUB:
+        writer.doubleSubResult(lhsId, rhsId);
+        trackAttached("BinaryArith.Double.Sub");
+        break;
       default:
         MOZ_CRASH("Unhandled Op");
     }
@@ -5132,7 +5136,7 @@ BinaryArithIRGenerator::tryAttachDouble()
 bool
 BinaryArithIRGenerator::tryAttachInt32()
 {
-    if (op_ != JSOP_ADD)
+    if (op_ != JSOP_ADD && op_ != JSOP_SUB)
         return false;
 
     if (!lhs_.isInt32() || !rhs_.isInt32())
@@ -5149,6 +5153,10 @@ BinaryArithIRGenerator::tryAttachInt32()
         writer.int32AddResult(lhsIntId, rhsIntId);
         trackAttached("BinaryArith.Int32.Add");
         break;
+      case JSOP_SUB:
+        writer.int32SubResult(lhsIntId, rhsIntId);
+        trackAttached("BinaryArith.Int32.Sub");
+        break;
       default:
         MOZ_CRASH("Unhandled op in tryAttachInt32");
     }

js/src/jit/CacheIR.h

@@ -290,7 +290,9 @@ extern const char* CacheKindNames[];
     _(LoadInstanceOfObjectResult)         \
     _(LoadTypeOfObjectResult)             \
     _(DoubleAddResult)                    \
+    _(DoubleSubResult)                    \
     _(Int32AddResult)                     \
+    _(Int32SubResult)                     \
     _(Int32NotResult)                     \
     _(Int32NegationResult)                \
     _(DoubleNegationResult)               \
@@ -993,10 +995,18 @@ class MOZ_RAII CacheIRWriter : public JS::CustomAutoRooter
         writeOpWithOperandId(CacheOp::DoubleAddResult, lhsId);
         writeOperandId(rhsId);
     }
+    void doubleSubResult(ValOperandId lhsId, ValOperandId rhsId) {
+        writeOpWithOperandId(CacheOp::DoubleSubResult, lhsId);
+        writeOperandId(rhsId);
+    }
     void int32AddResult(Int32OperandId lhs, Int32OperandId rhs) {
         writeOpWithOperandId(CacheOp::Int32AddResult, lhs);
         writeOperandId(rhs);
     }
+    void int32SubResult(Int32OperandId lhs, Int32OperandId rhs) {
+        writeOpWithOperandId(CacheOp::Int32SubResult, lhs);
+        writeOperandId(rhs);
+    }
     void int32NotResult(Int32OperandId id) {
         writeOpWithOperandId(CacheOp::Int32NotResult, id);
     }

js/src/jit/CacheIRCompiler.cpp

@@ -1938,6 +1938,24 @@ CacheIRCompiler::emitDoubleAddResult()
 
     return true;
 }
+bool
+CacheIRCompiler::emitDoubleSubResult()
+{
+    AutoOutputRegister output(*this);
+
+
+    FailurePath* failure;
+    if (!addFailurePath(&failure))
+        return false;
+
+    allocator.loadDouble(masm, reader.valOperandId(), FloatReg0, failure->label());
+    allocator.loadDouble(masm, reader.valOperandId(), FloatReg1, failure->label());
+
+    masm.subDouble(FloatReg1, FloatReg0);
+    masm.boxDouble(FloatReg0, output.valueReg(), FloatReg0);
+
+    return true;
+}
 
 bool
 CacheIRCompiler::emitInt32AddResult()
@@ -1955,6 +1973,22 @@ CacheIRCompiler::emitInt32AddResult()
 
     return true;
 }
+bool
+CacheIRCompiler::emitInt32SubResult()
+{
+    AutoOutputRegister output(*this);
+    Register lhs = allocator.useRegister(masm, reader.int32OperandId());
+    Register rhs = allocator.useRegister(masm, reader.int32OperandId());
+
+    FailurePath* failure;
+    if (!addFailurePath(&failure))
+        return false;
+
+    masm.branchSub32(Assembler::Overflow, rhs, lhs, failure->label());
+    EmitStoreResult(masm, lhs, JSVAL_TYPE_INT32, output);
+
+    return true;
+}
 
 bool
 CacheIRCompiler::emitInt32NegationResult()

js/src/jit/CacheIRCompiler.h

@@ -51,8 +51,10 @@ namespace jit {
     _(LoadUndefinedResult)                \
     _(LoadBooleanResult)                  \
     _(LoadInt32ArrayLengthResult)         \
-    _(Int32AddResult)                     \
     _(DoubleAddResult)                    \
+    _(DoubleSubResult)                    \
+    _(Int32AddResult)                     \
+    _(Int32SubResult)                     \
     _(Int32NegationResult)                \
     _(Int32NotResult)                     \
     _(DoubleNegationResult)               \

js/src/jit/IonBuilder.cpp

@@ -3553,13 +3553,13 @@ IonBuilder::arithTrySharedStub(bool* emitted, JSOp op,
         stub = MUnaryCache::New(alloc(), right);
         break;
       case JSOP_ADD:
+      case JSOP_SUB:
         // If not disabled, prefer the cache IR stub.
         if (!JitOptions.disableCacheIRBinaryArith) {
             stub = MBinaryCache::New(alloc(), left, right);
             break;
         }
         MOZ_FALLTHROUGH;
-      case JSOP_SUB:
       case JSOP_MUL:
       case JSOP_DIV:
       case JSOP_MOD:

js/src/jit/IonIC.cpp

@@ -568,6 +568,10 @@ IonBinaryArithIC::update(JSContext* cx, HandleScript outerScript, IonBinaryArith
         if (!AddValues(cx, &lhsCopy, &rhsCopy, ret))
             return false;
         break;
+      case JSOP_SUB:
+        if (!SubValues(cx, &lhsCopy, &rhsCopy, ret))
+            return false;
+        break;
       default:
         MOZ_CRASH("Unhandled binary arith op");
     }