Bug 1132888 part 3 - Fix assertRecoveredOnBailout optimization assertion. r=h4writer

js/src/jit-test/tests/ion/dce-with-rinstructions.js

@@ -3,6 +3,7 @@ setJitCompilerOption("ion.warmup.trigger", 20);
 var i;
 
 var config = getBuildConfiguration();
+var max = 200;
 
 // Check that we are able to remove the operation inside recover test functions (denoted by "rop..."),
 // when we inline the first version of uceFault, and ensure that the bailout is correct
@@ -1291,23 +1292,12 @@ function rhypot_object_4args(i) {
 var uceFault_random = eval(uneval(uceFault).replace('uceFault', 'uceFault_random'));
 function rrandom(i) {
     // setRNGState() exists only in debug builds
+    if(config.debug) setRNGState(2, 1+i);
 
-    if(config.debug) {
-        setRNGState(2, 0);
-        var x = Math.random();
-        if (uceFault_random(i) || uceFault_random(i)) {
-            setRNGState(2, 0);
-            assertEq(x, Math.random());
-        }
-        assertRecoveredOnBailout(x, true);
-    } else {
-        var x = Math.random();
-        if (uceFault_random(i) || uceFault_random(i)) {
-            Math.random();
-        }
-        assertRecoveredOnBailout(x, true);
-    }
-
+    var x = Math.random();
+    if (uceFault_random(i) || uceFault_random(i))
+        assertEq(x, config.debug ? setRNGState(2, 1+i) || Math.random() : x);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -1353,7 +1343,8 @@ function rlog_object(i) {
     return i;
 }
 
-for (i = 0; i < 100; i++) {
+for (j = 100 - max; j < 100; j++) {
+    let i = j < 2 ? (Math.abs(j) % 50) + 2 : j;
     rbitnot_number(i);
     rbitnot_object(i);
     rbitand_number(i);

js/src/jit-test/tests/ion/recover-objects.js

@@ -4,11 +4,17 @@
 // that Scalar Replacement optimization is working well independently of the
 // object representation.
 
+var max = 200;
+
 // Ion eager fails the test below because we have not yet created any
 // template object in baseline before running the content of the top-level
 // function.
-if (getJitCompilerOptions()["ion.warmup.trigger"] <= 90)
-    setJitCompilerOption("ion.warmup.trigger", 90);
+if (getJitCompilerOptions()["ion.warmup.trigger"] <= max - 10)
+    setJitCompilerOption("ion.warmup.trigger", max - 10);
+
+// Force Inlining heuristics to always inline the functions which have the same
+// number of use count.
+setJitCompilerOption("ion.warmup.trigger", getJitCompilerOptions()["ion.warmup.trigger"]);
 
 // This test checks that we are able to remove the getprop & setprop with scalar
 // replacement, so we should not force inline caches, as this would skip the
@@ -18,7 +24,7 @@ if (getJitCompilerOptions()["ion.forceinlineCaches"])
 
 function resumeHere() {}
 var uceFault = function (i) {
-    if (i > 98)
+    if (i > max - 2)
         uceFault = function (i) { return true; };
     return false;
 };
@@ -84,7 +90,7 @@ function notSoEmpty2(i) {
 
 // Check that we can recover objects with their content.
 var argFault_observeArg = function (i) {
-    if (i > 98)
+    if (i > max - 2)
         return inline_observeArg.arguments[0];
     return { test : i };
 };
@@ -135,9 +141,9 @@ function withinIf(i) {
 // Check case where one successor can have multiple times the same predecessor.
 function unknownLoad(i) {
     var obj = { foo: i };
+    // Unknown properties are inlined as undefined.
     assertEq(obj.bar, undefined);
-    // Unknown properties are using GetPropertyCache.
-    assertRecoveredOnBailout(obj, false);
+    assertRecoveredOnBailout(obj, true);
 }
 
 // Check with dynamic slots.
@@ -154,7 +160,7 @@ function dynamicSlots(i) {
     // beginning of the function.
     resumeHere(); bailout();
     assertEq(obj.p0 + obj.p10 + obj.p20 + obj.p30 + obj.p40, 5 * i + 100);
-    assertRecoveredOnBailout(obj, true);
+    assertRecoveredOnBailout(obj, false);
 }
 
 // Check that we can correctly recover allocations of new objects.
@@ -172,7 +178,7 @@ function createThisWithTemplate(i)
     assertRecoveredOnBailout(p, true);
 }
 
-for (var i = 0; i < 100; i++) {
+for (var i = 0; i < max; i++) {
     notSoEmpty1(i);
     notSoEmpty2(i);
     observeArg(i);

js/src/jit/ValueNumbering.cpp

@@ -727,7 +727,8 @@ ValueNumberer::visitDefinition(MDefinition* def)
         MResumePoint* rp = nop->resumePoint();
         if (rp && rp->numOperands() > 0 &&
             rp->getOperand(rp->numOperands() - 1) == prev &&
-            !nop->block()->lastIns()->isThrow())
+            !nop->block()->lastIns()->isThrow() &&
+            !prev->isAssertRecoveredOnBailout())
         {
             size_t numOperandsLive = 0;
             for (size_t j = 0; j < prev->numOperands(); j++) {