Bug 1350263 - Typeof object CacheIR support. r=jandem

js/src/jit/CacheIR.cpp

@@ -3593,7 +3593,8 @@ TypeOfIRGenerator::tryAttachStub()
     if (tryAttachPrimitive(valId))
         return true;
 
-    return false;
+    MOZ_ALWAYS_TRUE(tryAttachObject(valId));
+    return true;
 }
 
 bool
@@ -3609,3 +3610,16 @@ TypeOfIRGenerator::tryAttachPrimitive(ValOperandId valId)
     return true;
 }
 
+bool
+TypeOfIRGenerator::tryAttachObject(ValOperandId valId)
+{
+    if (!val_.isObject())
+        return false;
+
+    ObjOperandId objId = writer.guardIsObject(valId);
+    writer.loadTypeOfObjectResult(objId);
+    writer.returnFromIC();
+
+    return true;
+}
+

js/src/jit/CacheIR.h

@@ -247,6 +247,7 @@ extern const char* CacheKindNames[];
     _(LoadUndefinedResult)                \
     _(LoadBooleanResult)                  \
     _(LoadStringResult)                   \
+    _(LoadTypeOfObjectResult)             \
                                           \
     _(TypeMonitorResult)                  \
     _(ReturnFromIC)                       \
@@ -907,6 +908,9 @@ class MOZ_RAII CacheIRWriter : public JS::CustomAutoRooter
     void loadObjectResult(ObjOperandId obj) {
         writeOpWithOperandId(CacheOp::LoadObjectResult, obj);
     }
+    void loadTypeOfObjectResult(ObjOperandId obj) {
+        writeOpWithOperandId(CacheOp::LoadTypeOfObjectResult, obj);
+    }
 
     void typeMonitorResult() {
         writeOp(CacheOp::TypeMonitorResult);
@@ -1326,6 +1330,7 @@ class MOZ_RAII TypeOfIRGenerator : public IRGenerator
     HandleValue val_;
 
     bool tryAttachPrimitive(ValOperandId valId);
+    bool tryAttachObject(ValOperandId valId);
 
   public:
     TypeOfIRGenerator(JSContext* cx, HandleScript, jsbytecode* pc, ICState::Mode mode, HandleValue value);

js/src/jit/CacheIRCompiler.cpp

@@ -2145,6 +2145,51 @@ CacheIRCompiler::emitLoadObjectResult()
     return true;
 }
 
+bool
+CacheIRCompiler::emitLoadTypeOfObjectResult()
+{
+    AutoOutputRegister output(*this);
+    Register obj = allocator.useRegister(masm, reader.objOperandId());
+    AutoScratchRegisterMaybeOutput scratch(allocator, masm, output);
+
+    Label slowCheck, isObject, isCallable, isUndefined, done;
+    masm.typeOfObject(obj, scratch, &slowCheck, &isObject, &isCallable, &isUndefined);
+
+    masm.bind(&isCallable);
+    masm.moveValue(StringValue(cx_->names().function), output.valueReg());
+    masm.jump(&done);
+
+    masm.bind(&isUndefined);
+    masm.moveValue(StringValue(cx_->names().undefined), output.valueReg());
+    masm.jump(&done);
+
+    masm.bind(&isObject);
+    masm.moveValue(StringValue(cx_->names().object), output.valueReg());
+    masm.jump(&done);
+
+    {
+        masm.bind(&slowCheck);
+        LiveRegisterSet save(GeneralRegisterSet::Volatile(), liveVolatileFloatRegs());
+        masm.PushRegsInMask(save);
+
+        masm.setupUnalignedABICall(scratch);
+        masm.passABIArg(obj);
+        masm.movePtr(ImmPtr(cx_->runtime()), scratch);
+        masm.passABIArg(scratch);
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, TypeOfObject));
+        masm.mov(ReturnReg, scratch);
+
+        LiveRegisterSet ignore;
+        ignore.add(scratch);
+        masm.PopRegsInMaskIgnore(save, ignore);
+
+        masm.tagValue(JSVAL_TYPE_STRING, scratch, output.valueReg());
+    }
+
+    masm.bind(&done);
+    return true;
+}
+
 void
 CacheIRCompiler::emitStoreTypedObjectReferenceProp(ValueOperand val, ReferenceTypeDescr::Type type,
                                                    const Address& dest, Register scratch)

js/src/jit/CacheIRCompiler.h

@@ -52,6 +52,7 @@ namespace jit {
     _(LoadUnboxedArrayElementResult)      \
     _(LoadTypedElementResult)             \
     _(LoadObjectResult)                   \
+    _(LoadTypeOfObjectResult)             \
     _(MegamorphicLoadSlotByValueResult)   \
     _(MegamorphicHasOwnResult)            \
     _(WrapResult)