Bug 1738721 - Part 2: Remove unused MCreateThisWithTemplate node and associated machinery r=jandem

Differential Revision: https://phabricator.services.mozilla.com/D130105

js/src/jit/CodeGenerator.cpp

@@ -7289,25 +7289,6 @@ void CodeGenerator::visitCreateThis(LCreateThis* lir) {
   callVM<Fn, jit::CreateThisFromIon>(lir);
 }
 
-void CodeGenerator::visitCreateThisWithTemplate(LCreateThisWithTemplate* lir) {
-  JSObject* templateObject = lir->mir()->templateObject();
-  Register objReg = ToRegister(lir->output());
-  Register tempReg = ToRegister(lir->temp0());
-
-  using Fn = JSObject* (*)(JSContext*, HandleObject);
-  OutOfLineCode* ool = oolCallVM<Fn, CreateThisWithTemplate>(
-      lir, ArgList(ImmGCPtr(templateObject)), StoreRegisterTo(objReg));
-
-  // Allocate. If the FreeList is empty, call to VM, which may GC.
-  TemplateObject templateObj(templateObject);
-  bool initContents =
-      !templateObj.isPlainObject() || ShouldInitFixedSlots(lir, templateObj);
-  masm.createGCObject(objReg, tempReg, templateObj, lir->mir()->initialHeap(),
-                      ool->entry(), initContents);
-
-  masm.bind(ool->rejoin());
-}
-
 void CodeGenerator::visitCreateArgumentsObject(LCreateArgumentsObject* lir) {
   // This should be getting constructed in the first block only, and not any OSR
   // entry blocks.

js/src/jit/KnownClass.cpp

@@ -26,7 +26,6 @@ KnownClass jit::GetObjectKnownClass(const MDefinition* def) {
 
     case MDefinition::Opcode::NewObject:
     case MDefinition::Opcode::CreateThis:
-    case MDefinition::Opcode::CreateThisWithTemplate:
       return KnownClass::PlainObject;
 
     case MDefinition::Opcode::Lambda:

js/src/jit/LIROps.yaml

@@ -368,13 +368,6 @@
   call_instruction: true
   mir_op: true
 
-# Allocate an object for |new| on the caller-side.
-# Always performs object initialization with a fast path.
-- name: CreateThisWithTemplate
-  result_type: WordSized
-  num_temps: 1
-  mir_op: true
-
 # Allocate a new arguments object for the frame.
 - name: CreateArgumentsObject
   result_type: WordSized

js/src/jit/Lowering.cpp

@@ -257,12 +257,6 @@ void LIRGenerator::visitInitPropGetterSetter(MInitPropGetterSetter* ins) {
   assignSafepoint(lir, ins);
 }
 
-void LIRGenerator::visitCreateThisWithTemplate(MCreateThisWithTemplate* ins) {
-  LCreateThisWithTemplate* lir = new (alloc()) LCreateThisWithTemplate(temp());
-  define(lir, ins);
-  assignSafepoint(lir, ins);
-}
-
 void LIRGenerator::visitCreateThis(MCreateThis* ins) {
   LCreateThis* lir =
       new (alloc()) LCreateThis(useRegisterOrConstantAtStart(ins->callee()),

js/src/jit/MIR.cpp

@@ -4384,11 +4384,6 @@ void MBeta::printOpcode(GenericPrinter& out) const {
 }
 #endif
 
-bool MCreateThisWithTemplate::canRecoverOnBailout() const {
-  MOZ_ASSERT(templateObject()->is<PlainObject>());
-  return true;
-}
-
 AliasSet MCreateThis::getAliasSet() const {
   return AliasSet::Load(AliasSet::Any);
 }
@@ -4440,8 +4435,6 @@ JSObject* MObjectState::templateObjectOf(MDefinition* obj) {
 
   if (obj->isNewObject()) {
     return obj->toNewObject()->templateObject();
-  } else if (obj->isCreateThisWithTemplate()) {
-    return obj->toCreateThisWithTemplate()->templateObject();
   } else if (obj->isNewCallObject()) {
     return obj->toNewCallObject()->templateObject();
   } else if (obj->isNewIterator()) {

js/src/jit/MIR.h

@@ -2812,39 +2812,6 @@ class MAssertShape : public MUnaryInstruction, public NoTypePolicy::Data {
   AliasSet getAliasSet() const override { return AliasSet::None(); }
 };
 
-// Caller-side allocation of |this| for |new|:
-// Given a templateobject, construct |this| for JSOp::New.
-// Not used for JSOp::SuperCall, because Baseline doesn't attach template
-// objects for super calls.
-class MCreateThisWithTemplate : public MUnaryInstruction,
-                                public NoTypePolicy::Data {
-  gc::InitialHeap initialHeap_;
-
-  MCreateThisWithTemplate(MConstant* templateConst, gc::InitialHeap initialHeap)
-      : MUnaryInstruction(classOpcode, templateConst),
-        initialHeap_(initialHeap) {
-    setResultType(MIRType::Object);
-  }
-
- public:
-  INSTRUCTION_HEADER(CreateThisWithTemplate)
-  TRIVIAL_NEW_WRAPPERS
-
-  // Template for |this|, provided by TI.
-  JSObject* templateObject() const {
-    return &getOperand(0)->toConstant()->toObject();
-  }
-
-  gc::InitialHeap initialHeap() const { return initialHeap_; }
-
-  // Although creation of |this| modifies global state, it is safely repeatable.
-  AliasSet getAliasSet() const override { return AliasSet::None(); }
-
-  [[nodiscard]] bool writeRecoverData(
-      CompactBufferWriter& writer) const override;
-  bool canRecoverOnBailout() const override;
-};
-
 // Eager initialization of arguments object.
 class MCreateArgumentsObject : public MUnaryInstruction,
                                public ObjectPolicy<0>::Data {

js/src/jit/MIROps.yaml

@@ -378,9 +378,6 @@
 - name: AssertShape
   gen_boilerplate: false
 
-- name: CreateThisWithTemplate
-  gen_boilerplate: false
-
 # Caller-side allocation of |this| for |new|:
 # Constructs |this| when possible, else MagicValue(JS_IS_CONSTRUCTING).
 - name: CreateThis

js/src/jit/Recover.cpp

@@ -1695,31 +1695,6 @@ bool RNewIterator::recover(JSContext* cx, SnapshotIterator& iter) const {
   return true;
 }
 
-bool MCreateThisWithTemplate::writeRecoverData(
-    CompactBufferWriter& writer) const {
-  MOZ_ASSERT(canRecoverOnBailout());
-  writer.writeUnsigned(uint32_t(RInstruction::Recover_CreateThisWithTemplate));
-  return true;
-}
-
-RCreateThisWithTemplate::RCreateThisWithTemplate(CompactBufferReader& reader) {}
-
-bool RCreateThisWithTemplate::recover(JSContext* cx,
-                                      SnapshotIterator& iter) const {
-  RootedObject templateObject(cx, &iter.read().toObject());
-
-  // See CodeGenerator::visitCreateThisWithTemplate
-  JSObject* resultObject = CreateThisWithTemplate(cx, templateObject);
-  if (!resultObject) {
-    return false;
-  }
-
-  RootedValue result(cx);
-  result.setObject(*resultObject);
-  iter.storeInstructionResult(result);
-  return true;
-}
-
 bool MLambda::writeRecoverData(CompactBufferWriter& writer) const {
   MOZ_ASSERT(canRecoverOnBailout());
   writer.writeUnsigned(uint32_t(RInstruction::Recover_Lambda));

js/src/jit/Recover.h

@@ -123,7 +123,6 @@ namespace jit {
   _(NewArray)                     \
   _(NewIterator)                  \
   _(NewCallObject)                \
-  _(CreateThisWithTemplate)       \
   _(Lambda)                       \
   _(LambdaArrow)                  \
   _(FunctionWithProto)            \
@@ -795,14 +794,6 @@ class RNewIterator final : public RInstruction {
                              SnapshotIterator& iter) const override;
 };
 
-class RCreateThisWithTemplate final : public RInstruction {
- public:
-  RINSTRUCTION_HEADER_NUM_OP_(CreateThisWithTemplate, 1)
-
-  [[nodiscard]] bool recover(JSContext* cx,
-                             SnapshotIterator& iter) const override;
-};
-
 class RLambda final : public RInstruction {
  public:
   RINSTRUCTION_HEADER_NUM_OP_(Lambda, 2)

js/src/jit/ScalarReplacement.cpp

@@ -144,8 +144,7 @@ static bool IsLambdaEscaped(MInstruction* lambda, const Shape* shape) {
 
 static inline bool IsOptimizableObjectInstruction(MInstruction* ins) {
   return ins->isNewObject() || ins->isNewPlainObject() ||
-         ins->isCreateThisWithTemplate() || ins->isNewCallObject() ||
-         ins->isNewIterator();
+         ins->isNewCallObject() || ins->isNewIterator();
 }
 
 // Returns False if the object is not escaped and if it is optimizable by

js/src/jit/VMFunctionList-inl.h

@@ -111,7 +111,6 @@ namespace jit {
   _(CreateGeneratorFromFrame, js::jit::CreateGeneratorFromFrame)               \
   _(CreateThisFromIC, js::jit::CreateThisFromIC)                               \
   _(CreateThisFromIon, js::jit::CreateThisFromIon)                             \
-  _(CreateThisWithTemplate, js::CreateThisWithTemplate)                        \
   _(DebugAfterYield, js::jit::DebugAfterYield)                                 \
   _(DebugEpilogueOnBaselineReturn, js::jit::DebugEpilogueOnBaselineReturn)     \
   _(DebugLeaveLexicalEnv, js::jit::DebugLeaveLexicalEnv)                       \

js/src/vm/Interpreter.cpp

@@ -5046,18 +5046,6 @@ JSObject* js::NewPlainObjectOptimizedFallback(JSContext* cx, HandleShape shape,
   return NativeObject::create(cx, allocKind, initialHeap, shape, site);
 }
 
-JSObject* js::CreateThisWithTemplate(JSContext* cx,
-                                     HandleObject templateObject) {
-  mozilla::Maybe<AutoRealm> ar;
-  if (cx->realm() != templateObject->nonCCWRealm()) {
-    MOZ_ASSERT(cx->compartment() == templateObject->compartment());
-    ar.emplace(cx, templateObject);
-  }
-
-  RootedShape shape(cx, templateObject->shape());
-  return PlainObject::createWithShape(cx, shape);
-}
-
 ArrayObject* js::NewArrayOperation(
     JSContext* cx, uint32_t length,
     NewObjectKind newKind /* = GenericObject */) {

js/src/vm/Interpreter.h

@@ -626,8 +626,6 @@ JSObject* NewPlainObjectOptimizedFallback(JSContext* cx, HandleShape shape,
                                           gc::AllocKind allocKind,
                                           gc::InitialHeap initialHeap);
 
-JSObject* CreateThisWithTemplate(JSContext* cx, HandleObject templateObject);
-
 ArrayObject* NewArrayOperation(JSContext* cx, uint32_t length,
                                NewObjectKind newKind = GenericObject);