Bug 1083482 part 11 - Use infallible unbox for JSOP_ITERNEXT in Ion. r=evilpie

js/src/jit/BaselineBailouts.cpp

@@ -1789,18 +1789,6 @@ HandleLexicalCheckFailure(JSContext* cx, HandleScript outerScript, HandleScript
         Invalidate(cx, innerScript);
 }
 
-static void
-HandleIterNextNonStringBailout(JSContext* cx, HandleScript outerScript, HandleScript innerScript)
-{
-    JitSpew(JitSpew_IonBailouts, "Non-string iterator value %s:%zu, inlined into %s:%zu",
-            innerScript->filename(), innerScript->lineno(),
-            outerScript->filename(), outerScript->lineno());
-
-    // This should only happen when legacy generators are used.
-    ForbidCompilation(cx, innerScript);
-    InvalidateAfterBailout(cx, outerScript, "non-string iterator value");
-}
-
 static bool
 CopyFromRematerializedFrame(JSContext* cx, JitActivation* act, uint8_t* fp, size_t inlineDepth,
                             BaselineFrame* frame)
@@ -2041,10 +2029,6 @@ jit::FinishBailoutToBaseline(BaselineBailoutInfo* bailoutInfo)
         HandleBaselineInfoBailout(cx, outerScript, innerScript);
         break;
 
-      case Bailout_IterNextNonString:
-        HandleIterNextNonStringBailout(cx, outerScript, innerScript);
-        break;
-
       case Bailout_ArgumentCheck:
         // Do nothing, bailout will resume before the argument monitor ICs.
         break;

js/src/jit/IonBuilder.cpp

@@ -12629,11 +12629,8 @@ IonBuilder::jsop_iternext()
     MDefinition* def = current->pop();
     MOZ_ASSERT(def->type() == MIRType::Value);
 
-    // The value should be a string in most cases. Legacy generators can return
-    // non-string values, so in that case bailout and give up Ion compilation
-    // of the script.
-    MInstruction* unbox = MUnbox::New(alloc(), def, MIRType::String, MUnbox::Fallible,
-                                      Bailout_IterNextNonString);
+    // The value must be a string.
+    MInstruction* unbox = MUnbox::New(alloc(), def, MIRType::String, MUnbox::Infallible);
     current->add(unbox);
     current->push(unbox);
 

js/src/jit/IonTypes.h

@@ -132,10 +132,6 @@ enum BailoutKind
     // Like Bailout_Overflow, but causes immediate invalidation.
     Bailout_OverflowInvalidate,
 
-    // Like NonStringInput, but should cause immediate invalidation.
-    // Used for jsop_iternext.
-    Bailout_IterNextNonString,
-
     // Used for integer division, multiplication and modulo.
     // If there's a remainder, bails to return a double.
     // Can also signal overflow or result of -0.
@@ -229,8 +225,6 @@ BailoutKindString(BailoutKind kind)
       // Bailouts caused by invalid assumptions.
       case Bailout_OverflowInvalidate:
         return "Bailout_OverflowInvalidate";
-      case Bailout_IterNextNonString:
-        return "Bailout_IterNextNonString";
       case Bailout_DoubleOutput:
         return "Bailout_DoubleOutput";
 

js/src/vm/Interpreter.cpp

@@ -1977,7 +1977,6 @@ CASE(EnableInterruptsPseudoOpcode)
 CASE(JSOP_NOP)
 CASE(JSOP_NOP_DESTRUCTURING)
 CASE(JSOP_TRY_DESTRUCTURING_ITERCLOSE)
-CASE(JSOP_ITERNEXT)
 CASE(JSOP_UNUSED126)
 CASE(JSOP_UNUSED223)
 CASE(JSOP_CONDSWITCH)
@@ -2284,6 +2283,13 @@ CASE(JSOP_ISGENCLOSING)
 }
 END_CASE(JSOP_ISGENCLOSING)
 
+CASE(JSOP_ITERNEXT)
+{
+    // Ion relies on this.
+    MOZ_ASSERT(REGS.sp[-1].isString());
+}
+END_CASE(JSOP_ITERNEXT)
+
 CASE(JSOP_DUP)
 {
     MOZ_ASSERT(REGS.stackDepth() >= 1);