Bug 1511891 part 1 - Add BindVarOperation and use it for JSOP_BINDVAR in interpreter and JITs. r=tcampbell

This also adds a GetVariablesObject helper so we don't have to duplicate the
logic there.

Differential Revision: https://phabricator.services.mozilla.com/D13698

--HG--
extra : moz-landing-system : lando

js/src/jit/BaselineCompiler.cpp

@@ -2659,9 +2659,9 @@ bool BaselineCodeGen<Handler>::emit_JSOP_BINDGNAME() {
   return emitBindName(JSOP_BINDGNAME);
 }
 
-typedef JSObject* (*BindVarFn)(JSContext*, HandleObject);
+typedef JSObject* (*BindVarFn)(JSContext*, JSObject*);
 static const VMFunction BindVarInfo =
-    FunctionInfo<BindVarFn>(jit::BindVar, "BindVar");
+    FunctionInfo<BindVarFn>(BindVarOperation, "BindVarOperation");
 
 template <typename Handler>
 bool BaselineCodeGen<Handler>::emit_JSOP_BINDVAR() {

js/src/jit/CodeGenerator.cpp

@@ -10682,9 +10682,9 @@ void CodeGenerator::visitOutOfLineUnboxFloatingPoint(
   masm.jump(ool->rejoin());
 }
 
-typedef JSObject* (*BindVarFn)(JSContext*, HandleObject);
+typedef JSObject* (*BindVarFn)(JSContext*, JSObject*);
 static const VMFunction BindVarInfo =
-    FunctionInfo<BindVarFn>(jit::BindVar, "BindVar");
+    FunctionInfo<BindVarFn>(BindVarOperation, "BindVarOperation");
 
 void CodeGenerator::visitCallBindVar(LCallBindVar* lir) {
   pushArg(ToRegister(lir->environmentChain()));

js/src/jit/VMFunctions.cpp

@@ -189,19 +189,10 @@ bool CheckOverRecursedBaseline(JSContext* cx, BaselineFrame* frame) {
   return CheckOverRecursed(cx);
 }
 
-JSObject* BindVar(JSContext* cx, HandleObject envChain) {
-  JSObject* obj = envChain;
-  while (!obj->isQualifiedVarObj()) {
-    obj = obj->enclosingEnvironment();
-  }
-  MOZ_ASSERT(obj);
-  return obj;
-}
-
 bool DefVar(JSContext* cx, HandlePropertyName dn, unsigned attrs,
             HandleObject envChain) {
   // Given the ScopeChain, extract the VarObj.
-  RootedObject obj(cx, BindVar(cx, envChain));
+  RootedObject obj(cx, &GetVariablesObject(envChain));
   return DefVarOperation(cx, obj, dn, attrs);
 }
 
@@ -212,7 +203,7 @@ bool DefLexical(JSContext* cx, HandlePropertyName dn, unsigned attrs,
       cx, &NearestEnclosingExtensibleLexicalEnvironment(envChain));
 
   // Find the variables object.
-  RootedObject varObj(cx, BindVar(cx, envChain));
+  RootedObject varObj(cx, &GetVariablesObject(envChain));
   return DefLexicalOperation(cx, lexicalEnv, varObj, dn, attrs);
 }
 
@@ -938,7 +929,7 @@ bool CheckGlobalOrEvalDeclarationConflicts(JSContext* cx,
                                            BaselineFrame* frame) {
   RootedScript script(cx, frame->script());
   RootedObject envChain(cx, frame->environmentChain());
-  RootedObject varObj(cx, BindVar(cx, envChain));
+  RootedObject varObj(cx, &GetVariablesObject(envChain));
 
   if (script->isForEval()) {
     // Strict eval and eval in parameter default expressions have their

js/src/jit/VMFunctions.h

@@ -921,7 +921,6 @@ bool InvokeFromInterpreterStub(JSContext* cx,
 bool CheckOverRecursed(JSContext* cx);
 bool CheckOverRecursedBaseline(JSContext* cx, BaselineFrame* frame);
 
-JSObject* BindVar(JSContext* cx, HandleObject scopeChain);
 MOZ_MUST_USE bool DefVar(JSContext* cx, HandlePropertyName dn, unsigned attrs,
                          HandleObject scopeChain);
 MOZ_MUST_USE bool DefLexical(JSContext* cx, HandlePropertyName dn,

js/src/vm/EnvironmentObject-inl.h

@@ -24,6 +24,16 @@ inline LexicalEnvironmentObject& NearestEnclosingExtensibleLexicalEnvironment(
   return env->as<LexicalEnvironmentObject>();
 }
 
+// Returns the innermost "qualified var object" on the environment chain.
+// See the JSObject::isQualifiedVarObj comment for more info.
+inline JSObject& GetVariablesObject(JSObject* envChain) {
+  while (!envChain->isQualifiedVarObj()) {
+    envChain = envChain->enclosingEnvironment();
+  }
+  MOZ_ASSERT(envChain);
+  return *envChain;
+}
+
 inline void EnvironmentObject::setAliasedBinding(JSContext* cx, uint32_t slot,
                                                  PropertyName* name,
                                                  const Value& v) {

js/src/vm/Interpreter.cpp

@@ -2406,7 +2406,10 @@ static MOZ_NEVER_INLINE JS_HAZ_JSNATIVE_CALLER bool Interpret(JSContext* cx,
     }
     END_CASE(JSOP_BINDNAME)
 
-    CASE(JSOP_BINDVAR) { PUSH_OBJECT(REGS.fp()->varObj()); }
+    CASE(JSOP_BINDVAR) {
+      JSObject* varObj = BindVarOperation(cx, REGS.fp()->environmentChain());
+      PUSH_OBJECT(*varObj);
+    }
     END_CASE(JSOP_BINDVAR)
 
     CASE(JSOP_BITOR) {
@@ -4583,6 +4586,12 @@ JSObject* js::LambdaArrow(JSContext* cx, HandleFunction fun,
   return clone;
 }
 
+JSObject* js::BindVarOperation(JSContext* cx, JSObject* envChain) {
+  // Note: BindVarOperation has an unused cx argument because the JIT callVM
+  // machinery requires this.
+  return &GetVariablesObject(envChain);
+}
+
 bool js::DefFunOperation(JSContext* cx, HandleScript script,
                          HandleObject envChain, HandleFunction fun) {
   /*

js/src/vm/Interpreter.h

@@ -444,6 +444,8 @@ template <bool strict>
 bool DeleteElementJit(JSContext* cx, HandleValue val, HandleValue index,
                       bool* bv);
 
+JSObject* BindVarOperation(JSContext* cx, JSObject* envChain);
+
 bool DefFunOperation(JSContext* cx, HandleScript script, HandleObject envChain,
                      HandleFunction funArg);
 

js/src/vm/Stack-inl.h

@@ -36,11 +36,7 @@ inline GlobalObject& InterpreterFrame::global() const {
 }
 
 inline JSObject& InterpreterFrame::varObj() const {
-  JSObject* obj = environmentChain();
-  while (!obj->isQualifiedVarObj()) {
-    obj = obj->enclosingEnvironment();
-  }
-  return *obj;
+  return GetVariablesObject(environmentChain());
 }
 
 inline LexicalEnvironmentObject&