Bug 1674719 - Part 3: Transpile GuardIsNonNegative. r=jandem

Differential Revision: https://phabricator.services.mozilla.com/D95491

js/src/jit/CacheIROps.yaml

@@ -539,7 +539,7 @@
 
 - name: GuardIndexIsNonNegative
   shared: true
-  transpile: false
+  transpile: true
   cost_estimate: 1
   args:
     index: Int32Id

js/src/jit/CodeGenerator.cpp

@@ -14781,6 +14781,13 @@ void CodeGenerator::visitGuardIsExtensible(LGuardIsExtensible* lir) {
   bailoutFrom(&bail, lir->snapshot());
 }
 
+void CodeGenerator::visitGuardIndexIsNonNegative(
+    LGuardIndexIsNonNegative* lir) {
+  Register index = ToRegister(lir->index());
+
+  bailoutCmp32(Assembler::LessThan, index, Imm32(0), lir->snapshot());
+}
+
 template <size_t NumDefs>
 void CodeGenerator::emitIonToWasmCallBase(LIonToWasmCallBase<NumDefs>* lir) {
   wasm::JitCallStackArgVector stackArgs;

js/src/jit/Lowering.cpp

@@ -5499,6 +5499,16 @@ void LIRGenerator::visitGuardIsExtensible(MGuardIsExtensible* ins) {
   redefine(ins, object);
 }
 
+void LIRGenerator::visitGuardIndexIsNonNegative(MGuardIndexIsNonNegative* ins) {
+  MDefinition* index = ins->index();
+  MOZ_ASSERT(index->type() == MIRType::Int32);
+
+  auto* guard = new (alloc()) LGuardIndexIsNonNegative(useRegister(index));
+  assignSnapshot(guard, ins->bailoutKind());
+  add(guard, ins);
+  redefine(ins, index);
+}
+
 void LIRGenerator::visitConstant(MConstant* ins) {
   if (!IsFloatingPointType(ins->type()) && ins->canEmitAtUses()) {
     emitAtUses(ins);

js/src/jit/MIR.cpp

@@ -5817,6 +5817,16 @@ MDefinition* MCheckObjCoercible::foldsTo(TempAllocator& alloc) {
   return input;
 }
 
+MDefinition* MGuardIndexIsNonNegative::foldsTo(TempAllocator& alloc) {
+  MOZ_ASSERT(index()->type() == MIRType::Int32);
+
+  MDefinition* input = index();
+  if (!input->isConstant() || input->toConstant()->toInt32() < 0) {
+    return this;
+  }
+  return input;
+}
+
 MIonToWasmCall* MIonToWasmCall::New(TempAllocator& alloc,
                                     WasmInstanceObject* instanceObj,
                                     const wasm::FuncExport& funcExport) {

js/src/jit/MIR.h

@@ -12526,6 +12526,30 @@ class MGuardIsExtensible : public MUnaryInstruction,
   }
 };
 
+// Guard the input index is non-negative.
+class MGuardIndexIsNonNegative : public MUnaryInstruction,
+                                 public UnboxedInt32Policy<0>::Data {
+  explicit MGuardIndexIsNonNegative(MDefinition* index)
+      : MUnaryInstruction(classOpcode, index) {
+    setResultType(MIRType::Int32);
+    setMovable();
+    setGuard();
+  }
+
+ public:
+  INSTRUCTION_HEADER(GuardIndexIsNonNegative)
+  TRIVIAL_NEW_WRAPPERS
+  NAMED_OPERANDS((0, index))
+
+  AliasSet getAliasSet() const override { return AliasSet::None(); }
+
+  bool congruentTo(const MDefinition* ins) const override {
+    return congruentIfOperandsEqual(ins);
+  }
+
+  MDefinition* foldsTo(TempAllocator& alloc) override;
+};
+
 // Flips the input's sign bit, independently of the rest of the number's
 // payload. Note this is different from multiplying by minus-one, which has
 // side-effects for e.g. NaNs.

js/src/jit/WarpCacheIRTranspiler.cpp

@@ -1121,6 +1121,16 @@ bool WarpCacheIRTranspiler::emitGuardIsExtensible(ObjOperandId objId) {
   return true;
 }
 
+bool WarpCacheIRTranspiler::emitGuardIndexIsNonNegative(
+    Int32OperandId indexId) {
+  MDefinition* index = getOperand(indexId);
+
+  auto* ins = MGuardIndexIsNonNegative::New(alloc(), index);
+  add(ins);
+  setOperand(indexId, ins);
+  return true;
+}
+
 bool WarpCacheIRTranspiler::emitGuardTagNotEqual(ValueTagOperandId lhsId,
                                                  ValueTagOperandId rhsId) {
   MDefinition* lhs = getOperand(lhsId);

js/src/jit/shared/LIR-shared.h

@@ -8298,6 +8298,18 @@ class LGuardIsExtensible : public LInstructionHelper<0, 1, 1> {
   const LDefinition* temp() { return getTemp(0); }
 };
 
+class LGuardIndexIsNonNegative : public LInstructionHelper<0, 1, 0> {
+ public:
+  LIR_HEADER(GuardIndexIsNonNegative)
+
+  explicit LGuardIndexIsNonNegative(const LAllocation& index)
+      : LInstructionHelper(classOpcode) {
+    setOperand(0, index);
+  }
+
+  const LAllocation* index() { return getOperand(0); }
+};
+
 template <size_t NumDefs>
 class LIonToWasmCallBase : public LVariadicInstruction<NumDefs, 2> {
   using Base = LVariadicInstruction<NumDefs, 2>;