Bug 1092544 - Use assertRecoveredOnBailout in the test suite. r=bbouvier

js/src/builtin/TestingFunctions.cpp

@@ -1552,6 +1552,10 @@ bool
 js::testingFunc_assertFloat32(JSContext *cx, unsigned argc, jsval *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
+    if (args.length() != 2) {
+        JS_ReportError(cx, "Expects only 2 arguments");
+        return false;
+    }
 
     // NOP when not in IonMonkey
     args.rval().setUndefined();
@@ -1572,6 +1576,10 @@ bool
 js::testingFunc_assertRecoveredOnBailout(JSContext *cx, unsigned argc, jsval *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
+    if (args.length() != 2) {
+        JS_ReportError(cx, "Expects only 2 arguments");
+        return false;
+    }
 
     // NOP when not in IonMonkey
     args.rval().setUndefined();

js/src/jit-test/tests/SIMD/recover.js

@@ -3,6 +3,13 @@ load(libdir + 'simd.js');
 if (!this.hasOwnProperty("SIMD"))
   quit();
 
+// This test case ensure that if we are able to optimize SIMD, then we can use
+// recover instructions to get rid of the allocations. So, there is no value
+// (and the test case would fail) if we are not able to inline SIMD
+// constructors.
+if (!isSimdAvailable())
+  quit();
+
 setJitCompilerOption("baseline.warmup.trigger", 10);
 setJitCompilerOption("ion.warmup.trigger", 20);
 
@@ -19,18 +26,18 @@ var uceFault = function (i) {
 var uceFault_simdBox_i4 = eval(uneval(uceFault).replace('uceFault', 'uceFault_simdBox_i4'));
 function simdBox_i4(i) {
     var a = SIMD.int32x4(i, i, i, i);
-    if (uceFault_simdBox_i4(i) || uceFault_simdBox_i4(i)) {
+    if (uceFault_simdBox_i4(i) || uceFault_simdBox_i4(i))
         assertEqX4(a, [i, i, i, i]);
-    }
+    assertRecoveredOnBailout(a, true);
     return 0;
 }
 
 var uceFault_simdBox_f4 = eval(uneval(uceFault).replace('uceFault', 'uceFault_simdBox_f4'));
 function simdBox_f4(i) {
     var a = SIMD.float32x4(i, i + 0.1, i + 0.2, i + 0.3);
-    if (uceFault_simdBox_f4(i) || uceFault_simdBox_f4(i)) {
+    if (uceFault_simdBox_f4(i) || uceFault_simdBox_f4(i))
         assertEqX4(a, [i, i + 0.1, i + 0.2, i + 0.3].map(Math.fround));
-    }
+    assertRecoveredOnBailout(a, true);
     return 0;
 }
 

js/src/jit-test/tests/ion/dce-with-rinstructions.js

@@ -17,6 +17,7 @@ function rbitnot_number(i) {
     var x = ~i;
     if (uceFault_bitnot_number(i) || uceFault_bitnot_number(i))
         assertEq(x, -100  /* = ~99 */);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -28,6 +29,7 @@ function rbitnot_object(i) {
     t = 1000;
     if (uceFault_bitnot_object(i) || uceFault_bitnot_object(i))
         assertEq(x, -100  /* = ~99 */);
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -36,6 +38,7 @@ function rbitand_number(i) {
     var x = 1 & i;
     if (uceFault_bitand_number(i) || uceFault_bitand_number(i))
         assertEq(x, 1  /* = 1 & 99 */);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -47,6 +50,7 @@ function rbitand_object(i) {
     t = 1000;
     if (uceFault_bitand_object(i) || uceFault_bitand_object(i))
         assertEq(x, 99);
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -55,6 +59,7 @@ function rbitor_number(i) {
     var x = i | -100; /* -100 == ~99 */
     if (uceFault_bitor_number(i) || uceFault_bitor_number(i))
         assertEq(x, -1) /* ~99 | 99 = -1 */
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -66,6 +71,7 @@ function rbitor_object(i) {
     t = 1000;
     if (uceFault_bitor_object(i) || uceFault_bitor_object(i))
         assertEq(x, -1);
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -74,6 +80,7 @@ function rbitxor_number(i) {
     var x = 1 ^ i;
     if (uceFault_bitxor_number(i) || uceFault_bitxor_number(i))
         assertEq(x, 98  /* = 1 XOR 99 */);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -85,6 +92,7 @@ function rbitxor_object(i) {
     t = 1000;
     if (uceFault_bitxor_object(i) || uceFault_bitxor_object(i))
         assertEq(x, 98  /* = 1 XOR 99 */);
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -93,6 +101,7 @@ function rlsh_number(i) {
     var x = i << 1;
     if (uceFault_lsh_number(i) || uceFault_lsh_number(i))
         assertEq(x, 198); /* 99 << 1 == 198 */
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -104,6 +113,7 @@ function rlsh_object(i) {
     t = 1000;
     if (uceFault_lsh_object(i) || uceFault_lsh_object(i))
         assertEq(x, 198);
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -112,6 +122,7 @@ function rrsh_number(i) {
     var x = i >> 1;
     if (uceFault_rsh_number(i) || uceFault_rsh_number(i))
         assertEq(x, 49  /* = 99 >> 1 */);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -123,6 +134,7 @@ function rrsh_object(i) {
     t = 1000;
     if (uceFault_rsh_object(i) || uceFault_rsh_object(i))
         assertEq(x, 49  /* = 99 >> 1 */);
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -131,6 +143,7 @@ function rursh_number(i) {
     var x = i >>> 1;
     if (uceFault_ursh_number(i) || uceFault_ursh_number(i))
         assertEq(x, 49  /* = 99 >>> 1 */);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -142,6 +155,7 @@ function rursh_object(i) {
     t = 1000;
     if (uceFault_ursh_object(i) || uceFault_ursh_object(i))
         assertEq(x, 49  /* = 99 >>> 1 */);
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -150,7 +164,7 @@ function radd_number(i) {
     var x = 1 + i;
     if (uceFault_add_number(i) || uceFault_add_number(i))
         assertEq(x, 100  /* = 1 + 99 */);
-    assertRecoveredOnBailout(x);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -161,6 +175,7 @@ function radd_float(i) {
     var x = Math.fround(Math.fround(Math.fround(Math.fround(t + fi) + t) + fi) + t);
     if (uceFault_add_float(i) || uceFault_add_float(i))
         assertEq(x, 199); /* != 199.00000002980232 (when computed with double additions) */
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -172,6 +187,7 @@ function radd_object(i) {
     t = 1000;
     if (uceFault_add_object(i) || uceFault_add_object(i))
         assertEq(x, 198);
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -180,6 +196,7 @@ function rsub_number(i) {
     var x = 1 - i;
     if (uceFault_sub_number(i) || uceFault_sub_number(i))
         assertEq(x, -98  /* = 1 - 99 */);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -190,6 +207,7 @@ function rsub_float(i) {
     var x = Math.fround(Math.fround(Math.fround(Math.fround(t - fi) - t) - fi) - t);
     if (uceFault_sub_float(i) || uceFault_sub_float(i))
         assertEq(x, -198.3333282470703); /* != -198.33333334326744 (when computed with double subtractions) */
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -201,6 +219,7 @@ function rsub_object(i) {
     t = 1000;
     if (uceFault_sub_object(i) || uceFault_sub_object(i))
         assertEq(x, 0);
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -209,6 +228,7 @@ function rmul_number(i) {
     var x = 2 * i;
     if (uceFault_mul_number(i) || uceFault_mul_number(i))
         assertEq(x, 198  /* = 1 * 99 */);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -219,6 +239,7 @@ function rmul_float(i) {
     var x = Math.fround(Math.fround(Math.fround(Math.fround(t * fi) * t) * fi) * t);
     if (uceFault_mul_float(i) || uceFault_mul_float(i))
         assertEq(x, 363); /* != 363.0000324547301 (when computed with double multiplications) */
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -230,6 +251,7 @@ function rmul_object(i) {
     t = 1000;
     if (uceFault_mul_object(i) || uceFault_mul_object(i))
         assertEq(x, 9801);
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -238,6 +260,7 @@ function rdiv_number(i) {
     var x = 1 / i;
     if (uceFault_div_number(i) || uceFault_div_number(i))
         assertEq(x, 0.010101010101010102  /* = 1 / 99 */);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -248,6 +271,7 @@ function rdiv_float(i) {
     var x = Math.fround(Math.fround(Math.fround(Math.fround(t / fi) / t) / fi) / t);
     if (uceFault_div_float(i) || uceFault_div_float(i))
         assertEq(x, 0.0003060912131331861); /* != 0.0003060912060598955 (when computed with double divisions) */
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -259,6 +283,7 @@ function rdiv_object(i) {
     t = 1000;
     if (uceFault_div_object(i) || uceFault_div_object(i))
         assertEq(x, 1);
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -267,6 +292,7 @@ function rmod_number(i) {
     var x = i % 98;
     if (uceFault_mod_number(i) || uceFault_mod_number(i))
         assertEq(x, 1); /* 99 % 98 = 1 */
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -278,6 +304,7 @@ function rmod_object(i) {
     t = 1000;
     if(uceFault_mod_object(i) || uceFault_mod_object(i))
         assertEq(x, 1); /* 99 % 98 = 1 */
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -286,6 +313,7 @@ function rnot_number(i) {
     var x = !i;
     if (uceFault_not_number(i) || uceFault_not_number(i))
         assertEq(x, false /* = !99 */);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -295,6 +323,7 @@ function rnot_object(i) {
     var x = !o;
     if(uceFault_not_object(i) || uceFault_not_object(i))
         assertEq(x, true /* = !undefined = !document.all = !objectEmulatingUndefined() */);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -303,6 +332,7 @@ function rconcat_string(i) {
     var x = "s" + i.toString();
     if (uceFault_concat_string(i) || uceFault_concat_string(i))
         assertEq(x, "s99");
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -311,6 +341,7 @@ function rconcat_number(i) {
     var x = "s" + i;
     if (uceFault_concat_number(i) || uceFault_concat_number(i))
         assertEq(x, "s99");
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -319,6 +350,7 @@ function rstring_length(i) {
     var x = i.toString().length;
     if (uceFault_string_length(i) || uceFault_string_length(i))
         assertEq(x, 2);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -327,6 +359,7 @@ function rarguments_length_1(i) {
     var x = arguments.length;
     if (uceFault_arguments_length_1(i) || uceFault_arguments_length_1(i))
         assertEq(x, 1);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -335,6 +368,7 @@ function rarguments_length_3(i) {
     var x = arguments.length;
     if (uceFault_arguments_length_3(i) || uceFault_arguments_length_3(i))
         assertEq(x, 3);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -345,6 +379,8 @@ function rinline_arguments_length_1(i) {
     var x = ret_argumentsLength.apply(this, arguments);
     if (uceFault_inline_arguments_length_1(i) || uceFault_inline_arguments_length_1(i))
         assertEq(x, 1);
+    // We cannot garantee that the function would be inlined
+    // assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -353,6 +389,8 @@ function rinline_arguments_length_3(i) {
     var x = ret_argumentsLength.apply(this, arguments);
     if (uceFault_inline_arguments_length_3(i) || uceFault_inline_arguments_length_3(i))
         assertEq(x, 3);
+    // We cannot garantee that the function would be inlined
+    // assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -361,6 +399,7 @@ function rfloor_number(i) {
     var x = Math.floor(i + 0.1111);
     if (uceFault_floor_number(i) || uceFault_floor_number(i))
         assertEq(x, i);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -372,14 +411,17 @@ function rfloor_object(i) {
     t = 1000.1111;
     if (uceFault_floor_object(i) || uceFault_floor_object(i))
         assertEq(x, i);
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
 var uceFault_ceil_number = eval(uneval(uceFault).replace('uceFault', 'uceFault_ceil_number'));
-function rceil_number(i){
+function rceil_number(i) {
     var x = Math.ceil(-i - 0.12010799100);
-    if (uceFault_ceil_number(i) ||uceFault_ceil_number(i))
+    if (uceFault_ceil_number(i) || uceFault_ceil_number(i))
         assertEq(x, - i);
+    // NYI: uses MMathFunction and not MCeil.
+    // assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -388,6 +430,7 @@ function rround_number(i) {
     var x = Math.round(i + 1.4);
     if (uceFault_round_number(i) || uceFault_round_number(i))
         assertEq(x, 100); /* = i + 1*/
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -396,7 +439,8 @@ function rround_double(i) {
     var x = Math.round(i + (-1 >>> 0));
     if (uceFault_round_double(i) || uceFault_round_double(i))
         assertEq(x, 99 + (-1 >>> 0)); /* = i + 2 ^ 32 - 1 */
-     return i;
+    assertRecoveredOnBailout(x, true);
+    return i;
 }
 
 var uceFault_Char_Code_At = eval(uneval(uceFault).replace('uceFault', 'uceFault_Char_Code_At'));
@@ -405,6 +449,7 @@ function rcharCodeAt(i) {
     var x = s.charCodeAt(i % 4);
     if (uceFault_Char_Code_At(i) || uceFault_Char_Code_At(i))
         assertEq(x, 97 );
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -413,6 +458,7 @@ function rfrom_char_code(i) {
     var x = String.fromCharCode(i);
     if (uceFault_from_char_code(i) || uceFault_from_char_code(i))
         assertEq(x, "c");
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -421,6 +467,7 @@ function rfrom_char_code_non_ascii(i) {
     var x = String.fromCharCode(i * 100);
     if (uceFault_from_char_code_non_ascii(i) || uceFault_from_char_code_non_ascii(i))
         assertEq(x, "\u26AC");
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -429,6 +476,7 @@ function rpow_number(i) {
     var x = Math.pow(i, 3.14159);
     if (uceFault_pow_number(i) || uceFault_pow_number(i))
         assertEq(x, Math.pow(99, 3.14159));
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -440,6 +488,7 @@ function rpow_object(i) {
     t = 1.5;
     if (uceFault_pow_object(i) || uceFault_pow_object(i))
         assertEq(x, Math.pow(99, 3.14159));
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -448,6 +497,7 @@ function rpowhalf_number(i) {
     var x = Math.pow(i, 0.5);
     if (uceFault_powhalf_number(i) || uceFault_powhalf_number(i))
         assertEq(x, Math.pow(99, 0.5));
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -459,6 +509,7 @@ function rpowhalf_object(i) {
     t = 1.5;
     if (uceFault_powhalf_object(i) || uceFault_powhalf_object(i))
         assertEq(x, Math.pow(99, 0.5));
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -467,14 +518,16 @@ function rmin_number(i) {
     var x = Math.min(i, i-1, i-2.1);
     if (uceFault_min_number(i) || uceFault_min_number(i))
         assertEq(x, i-2.1);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
 var uceFault_min_float = eval(uneval(uceFault).replace('uceFault', 'uceFault_min_float'));
 function rmin_float(i) {
-    var x = Math.fround(Math.min(Math.fround(20), Math.fround(13.37)));
+    var x = Math.fround(Math.min(Math.fround(i), Math.fround(13.37)));
     if (uceFault_min_number(i) || uceFault_min_number(i))
         assertEq(x, Math.fround(13.37));
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -486,6 +539,7 @@ function rmin_object(i) {
     t = 1000;
     if (uceFault_min_object(i) || uceFault_min_object(i))
         assertEq(x, i-2.1);
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -494,14 +548,16 @@ function rmax_number(i) {
     var x = Math.max(i, i-1, i-2.1);
     if (uceFault_max_number(i) || uceFault_max_number(i))
         assertEq(x, i);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
 var uceFault_max_float = eval(uneval(uceFault).replace('uceFault', 'uceFault_max_float'));
 function rmax_float(i) {
-    var x = Math.fround(Math.max(Math.fround(2), Math.fround(13.37)));
+    var x = Math.fround(Math.max(Math.fround(-i), Math.fround(13.37)));
     if (uceFault_max_number(i) || uceFault_max_number(i))
         assertEq(x, Math.fround(13.37));
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -513,6 +569,7 @@ function rmax_object(i) {
     t = 1000;
     if (uceFault_max_object(i) || uceFault_max_object(i))
         assertEq(x, i);
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -521,6 +578,7 @@ function rabs_number(i) {
     var x = Math.abs(i-42);
     if (uceFault_abs(i) || uceFault_abs(i))
         assertEq(x, 57);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -532,6 +590,7 @@ function rabs_object(i) {
     t = 1000;
     if(uceFault_abs_object(i) || uceFault_abs_object(i))
         assertEq(x, 99);
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -540,6 +599,7 @@ function rsqrt_number(i) {
     var x = Math.sqrt(i);
     if (uceFault_sqrt_number(i) || uceFault_sqrt_number(i))
         assertEq(x, Math.sqrt(99));
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -548,6 +608,7 @@ function rsqrt_float(i) {
     var x = Math.fround(Math.sqrt(Math.fround(i)));
     if (uceFault_sqrt_float(i) || uceFault_sqrt_float(i))
         assertEq(x, Math.fround(Math.sqrt(Math.fround(99)))); /* != 9.9498743710662 (when computed with double sqrt) */
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -559,6 +620,7 @@ function rsqrt_object(i) {
     t = 1.5;
     if (uceFault_sqrt_object(i) || uceFault_sqrt_object(i))
         assertEq(x, Math.sqrt(99));
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -567,6 +629,7 @@ function ratan2_number(i) {
     var x = Math.atan2(i, i+1);
     if (uceFault_atan2_number(i) || uceFault_atan2_number(i))
         assertEq(x, Math.atan2(99, 100));
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -578,15 +641,16 @@ function ratan2_object(i) {
     t = 1000;
     if (uceFault_atan2_object(i) || uceFault_atan2_object(i))
         assertEq(x, Math.atan2(i, i+1));
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
 var uceFault_str_split = eval(uneval(uceFault).replace('uceFault', 'uceFault_str_split'))
 function rstr_split(i) {
     var x = "str01234567899876543210rts".split("" + i);
-    if (uceFault_str_split(i) || uceFault_str_split(i)) {
+    if (uceFault_str_split(i) || uceFault_str_split(i))
         assertEq(x[0], "str012345678");
-    }
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -594,20 +658,18 @@ var uceFault_regexp_exec = eval(uneval(uceFault).replace('uceFault', 'uceFault_r
 function rregexp_exec(i) {
     var re = new RegExp("(str)\\d+" + i + "\\d+rts");
     var res = re.exec("str01234567899876543210rts");
-    if (uceFault_regexp_exec(i) || uceFault_regexp_exec(i)) {
+    if (uceFault_regexp_exec(i) || uceFault_regexp_exec(i))
         assertEq(res[1], "str");
-    }
-
+    assertRecoveredOnBailout(res, false);
     return i;
 }
 var uceFault_regexp_y_exec = eval(uneval(uceFault).replace('uceFault', 'uceFault_regexp_y_exec'))
 function rregexp_y_exec(i) {
     var re = new RegExp("(str)\\d+" + (i % 10), "y");
     var res = re.exec("str00123456789");
-    if (uceFault_regexp_y_exec(i) || uceFault_regexp_y_exec(i)) {
+    if (uceFault_regexp_y_exec(i) || uceFault_regexp_y_exec(i))
         assertEq(res[1], "str");
-    }
-
+    assertRecoveredOnBailout(res, false);
     assertEq(re.lastIndex == 0, false);
     return i;
 }
@@ -616,10 +678,9 @@ var uceFault_regexp_y_literal_exec = eval(uneval(uceFault).replace('uceFault', '
 function rregexp_y_literal_exec(i) {
     var re = /(str)\d*0/y;
     var res = re.exec("str00123456789");
-    if (uceFault_regexp_y_literal_exec(i) || uceFault_regexp_y_literal_exec(i)) {
+    if (uceFault_regexp_y_literal_exec(i) || uceFault_regexp_y_literal_exec(i))
         assertEq(res[1], "str");
-    }
-
+    assertRecoveredOnBailout(res, false);
     assertEq(re.lastIndex == 0, false);
     return i;
 }
@@ -628,10 +689,9 @@ var uceFault_regexp_g_exec = eval(uneval(uceFault).replace('uceFault', 'uceFault
 function rregexp_g_exec(i) {
     var re = new RegExp("(str)\\d+" + (i % 10), "g");
     var res = re.exec("str00123456789str00123456789");
-    if (uceFault_regexp_g_exec(i) || uceFault_regexp_g_exec(i)) {
+    if (uceFault_regexp_g_exec(i) || uceFault_regexp_g_exec(i))
         assertEq(res[1], "str");
-    }
-
+    assertRecoveredOnBailout(res, false);
     assertEq(re.lastIndex == 0, false);
     return i;
 }
@@ -640,10 +700,9 @@ var uceFault_regexp_g_literal_exec = eval(uneval(uceFault).replace('uceFault', '
 function rregexp_g_literal_exec(i) {
     var re = /(str)\d*0/g;
     var res = re.exec("str00123456789str00123456789");
-    if (uceFault_regexp_g_literal_exec(i) || uceFault_regexp_g_literal_exec(i)) {
+    if (uceFault_regexp_g_literal_exec(i) || uceFault_regexp_g_literal_exec(i))
         assertEq(res[1], "str");
-    }
-
+    assertRecoveredOnBailout(res, false);
     assertEq(re.lastIndex == 0, false);
     return i;
 }
@@ -652,10 +711,9 @@ var uceFault_regexp_i_exec = eval(uneval(uceFault).replace('uceFault', 'uceFault
 function rregexp_i_exec(i) {
     var re = new RegExp("(str)\\d+" + (i % 10), "i");
     var res = re.exec("STR00123456789");
-    if (uceFault_regexp_i_exec(i) || uceFault_regexp_i_exec(i)) {
+    if (uceFault_regexp_i_exec(i) || uceFault_regexp_i_exec(i))
         assertEq(res[1], "STR");
-    }
-
+    assertRecoveredOnBailout(res, false);
     assertEq(re.lastIndex == 0, true);
     return i;
 }
@@ -664,10 +722,9 @@ var uceFault_regexp_i_literal_exec = eval(uneval(uceFault).replace('uceFault', '
 function rregexp_i_literal_exec(i) {
     var re = /(str)\d*0/i;
     var res = re.exec("STR00123456789");
-    if (uceFault_regexp_i_literal_exec(i) || uceFault_regexp_i_literal_exec(i)) {
+    if (uceFault_regexp_i_literal_exec(i) || uceFault_regexp_i_literal_exec(i))
         assertEq(res[1], "STR");
-    }
-
+    assertRecoveredOnBailout(res, false);
     assertEq(re.lastIndex == 0, true);
     return i;
 }
@@ -677,10 +734,9 @@ var uceFault_regexp_m_exec = eval(uneval(uceFault).replace('uceFault', 'uceFault
 function rregexp_m_exec(i) {
     var re = new RegExp("^(str)\\d+" + (i % 10), "m");
     var res = re.exec("abc\nstr00123456789");
-    if (uceFault_regexp_m_exec(i) || uceFault_regexp_m_exec(i)) {
+    if (uceFault_regexp_m_exec(i) || uceFault_regexp_m_exec(i))
         assertEq(res[1], "str");
-    }
-
+    assertRecoveredOnBailout(res, false);
     assertEq(re.lastIndex == 0, true);
     return i;
 }
@@ -689,10 +745,9 @@ var uceFault_regexp_m_literal_exec = eval(uneval(uceFault).replace('uceFault', '
 function rregexp_m_literal_exec(i) {
     var re = /^(str)\d*0/m;
     var res = re.exec("abc\nstr00123456789");
-    if (uceFault_regexp_m_literal_exec(i) || uceFault_regexp_m_literal_exec(i)) {
+    if (uceFault_regexp_m_literal_exec(i) || uceFault_regexp_m_literal_exec(i))
         assertEq(res[1], "str");
-    }
-
+    assertRecoveredOnBailout(res, false);
     assertEq(re.lastIndex == 0, true);
     return i;
 }
@@ -701,9 +756,9 @@ var uceFault_regexp_test = eval(uneval(uceFault).replace('uceFault', 'uceFault_r
 function rregexp_test(i) {
     var re = new RegExp("str\\d+" + i + "\\d+rts");
     var res = re.test("str01234567899876543210rts");
-    if (uceFault_regexp_test(i) || uceFault_regexp_test(i)) {
+    if (uceFault_regexp_test(i) || uceFault_regexp_test(i))
         assertEq(res, true);
-    }
+    assertRecoveredOnBailout(res, false);
     return i;
 }
 
@@ -711,10 +766,9 @@ var uceFault_regexp_y_test = eval(uneval(uceFault).replace('uceFault', 'uceFault
 function rregexp_y_test(i) {
     var re = new RegExp("str\\d+" + (i % 10), "y");
     var res = re.test("str00123456789");
-    if (uceFault_regexp_y_test(i) || uceFault_regexp_y_test(i)) {
+    if (uceFault_regexp_y_test(i) || uceFault_regexp_y_test(i))
         assertEq(res, true);
-    }
-
+    assertRecoveredOnBailout(res, false);
     assertEq(re.lastIndex == 0, false);
     return i;
 }
@@ -723,10 +777,9 @@ var uceFault_regexp_y_literal_test = eval(uneval(uceFault).replace('uceFault', '
 function rregexp_y_literal_test(i) {
     var re = /str\d*0/y;
     var res = re.test("str00123456789");
-    if (uceFault_regexp_y_literal_test(i) || uceFault_regexp_y_literal_test(i)) {
+    if (uceFault_regexp_y_literal_test(i) || uceFault_regexp_y_literal_test(i))
         assertEq(res, true);
-    }
-
+    assertRecoveredOnBailout(res, false);
     assertEq(re.lastIndex == 0, false);
     return i;
 }
@@ -735,10 +788,9 @@ var uceFault_regexp_g_test = eval(uneval(uceFault).replace('uceFault', 'uceFault
 function rregexp_g_test(i) {
     var re = new RegExp("str\\d+" + (i % 10), "g");
     var res = re.test("str00123456789str00123456789");
-    if (uceFault_regexp_g_test(i) || uceFault_regexp_g_test(i)) {
+    if (uceFault_regexp_g_test(i) || uceFault_regexp_g_test(i))
         assertEq(res, true);
-    }
-
+    assertRecoveredOnBailout(res, false);
     assertEq(re.lastIndex == 0, false);
     return i;
 }
@@ -747,10 +799,9 @@ var uceFault_regexp_g_literal_test = eval(uneval(uceFault).replace('uceFault', '
 function rregexp_g_literal_test(i) {
     var re = /str\d*0/g;
     var res = re.test("str00123456789str00123456789");
-    if (uceFault_regexp_g_literal_test(i) || uceFault_regexp_g_literal_test(i)) {
+    if (uceFault_regexp_g_literal_test(i) || uceFault_regexp_g_literal_test(i))
         assertEq(res, true);
-    }
-
+    assertRecoveredOnBailout(res, false);
     assertEq(re.lastIndex == 0, false);
     return i;
 }
@@ -759,10 +810,9 @@ var uceFault_regexp_i_test = eval(uneval(uceFault).replace('uceFault', 'uceFault
 function rregexp_i_test(i) {
     var re = new RegExp("str\\d+" + (i % 10), "i");
     var res = re.test("STR00123456789");
-    if (uceFault_regexp_i_test(i) || uceFault_regexp_i_test(i)) {
+    if (uceFault_regexp_i_test(i) || uceFault_regexp_i_test(i))
         assertEq(res, true);
-    }
-
+    assertRecoveredOnBailout(res, false);
     assertEq(re.lastIndex == 0, true);
     return i;
 }
@@ -771,10 +821,9 @@ var uceFault_regexp_i_literal_test = eval(uneval(uceFault).replace('uceFault', '
 function rregexp_i_literal_test(i) {
     var re = /str\d*0/i;
     var res = re.test("STR00123456789");
-    if (uceFault_regexp_i_literal_test(i) || uceFault_regexp_i_literal_test(i)) {
+    if (uceFault_regexp_i_literal_test(i) || uceFault_regexp_i_literal_test(i))
         assertEq(res, true);
-    }
-
+    assertRecoveredOnBailout(res, false);
     assertEq(re.lastIndex == 0, true);
     return i;
 }
@@ -783,10 +832,9 @@ var uceFault_regexp_m_test = eval(uneval(uceFault).replace('uceFault', 'uceFault
 function rregexp_m_test(i) {
     var re = new RegExp("^str\\d+" + (i % 10), "m");
     var res = re.test("abc\nstr00123456789");
-    if (uceFault_regexp_m_test(i) || uceFault_regexp_m_test(i)) {
+    if (uceFault_regexp_m_test(i) || uceFault_regexp_m_test(i))
         assertEq(res, true);
-    }
-
+    assertRecoveredOnBailout(res, false);
     assertEq(re.lastIndex == 0, true);
     return i;
 }
@@ -795,10 +843,9 @@ var uceFault_regexp_m_literal_test = eval(uneval(uceFault).replace('uceFault', '
 function rregexp_m_literal_test(i) {
     var re = /^str\d*0/m;
     var res = re.test("abc\nstr00123456789");
-    if (uceFault_regexp_m_literal_test(i) || uceFault_regexp_m_literal_test(i)) {
+    if (uceFault_regexp_m_literal_test(i) || uceFault_regexp_m_literal_test(i))
         assertEq(res, true);
-    }
-
+    assertRecoveredOnBailout(res, false);
     assertEq(re.lastIndex == 0, true);
     return i;
 }
@@ -807,9 +854,9 @@ var uceFault_regexp_replace = eval(uneval(uceFault).replace('uceFault', 'uceFaul
 function rregexp_replace(i) {
     var re = new RegExp("str\\d+" + (i % 10));
     var res = "str00123456789".replace(re, "abc");
-    if (uceFault_regexp_replace(i) || uceFault_regexp_replace(i)) {
+    if (uceFault_regexp_replace(i) || uceFault_regexp_replace(i))
         assertEq(res, "abc");
-    }
+    assertRecoveredOnBailout(res, false);
     return i;
 }
 
@@ -826,6 +873,7 @@ function rregexp_y_replace(i) {
 
     if (uceFault_regexp_y_replace(i) || uceFault_regexp_y_replace(i))
         assertEq(res, "abc");
+    assertRecoveredOnBailout(res, false);
     return i;
 }
 
@@ -841,6 +889,7 @@ function rregexp_y_literal_replace(i) {
 
     if (uceFault_regexp_y_literal_replace(i) || uceFault_regexp_y_literal_replace(i))
         assertEq(res, "abc");
+    assertRecoveredOnBailout(res, false);
     return i;
 }
 
@@ -857,6 +906,7 @@ function rregexp_g_replace(i) {
 
     if (uceFault_regexp_g_replace(i) || uceFault_regexp_g_replace(i))
         assertEq(res, "abc");
+    assertRecoveredOnBailout(res, false);
     return i;
 }
 
@@ -873,6 +923,7 @@ function rregexp_g_literal_replace(i) {
 
     if (uceFault_regexp_g_literal_replace(i) || uceFault_regexp_g_literal_replace(i))
         assertEq(res, "abc");
+    assertRecoveredOnBailout(res, false);
     return i;
 }
 
@@ -888,6 +939,7 @@ function rregexp_i_replace(i) {
 
     if (uceFault_regexp_i_replace(i) || uceFault_regexp_i_replace(i))
         assertEq(res, "abc");
+    assertRecoveredOnBailout(res, false);
     return i;
 }
 
@@ -903,6 +955,7 @@ function rregexp_i_literal_replace(i) {
 
     if (uceFault_regexp_i_literal_replace(i) || uceFault_regexp_i_literal_replace(i))
         assertEq(res, "abc");
+    assertRecoveredOnBailout(res, false);
     return i;
 }
 
@@ -918,6 +971,7 @@ function rregexp_m_replace(i) {
 
     if (uceFault_regexp_m_replace(i) || uceFault_regexp_m_replace(i))
         assertEq(res, "abc\nabc");
+    assertRecoveredOnBailout(res, false);
     return i;
 }
 
@@ -933,6 +987,7 @@ function rregexp_m_literal_replace(i) {
 
     if (uceFault_regexp_m_literal_replace(i) || uceFault_regexp_m_literal_replace(i))
         assertEq(res, "abc\nabc");
+    assertRecoveredOnBailout(res, false);
     return i;
 }
 
@@ -942,11 +997,10 @@ function rstring_replace(i) {
 
     assertEq(re.lastIndex == 0, true);
     var res = "str00123456789".replace(re, "abc");
-    if (uceFault_string_replace(i) || uceFault_string_replace(i)) {
+    if (uceFault_string_replace(i) || uceFault_string_replace(i))
         assertEq(res, "abc");
-    }
+    assertRecoveredOnBailout(res, false);
     assertEq(re.lastIndex == 0, true);
-
     return i;
 }
 
@@ -956,11 +1010,10 @@ function rstring_replace_y(i) {
 
     assertEq(re.lastIndex == 0, true);
     var res = "str00123456789".replace(re, "abc");
-    if (uceFault_string_replace_y(i) || uceFault_string_replace_y(i)) {
+    if (uceFault_string_replace_y(i) || uceFault_string_replace_y(i))
         assertEq(res, "abc");
-    }
+    assertRecoveredOnBailout(res, false);
     assertEq(re.lastIndex == 0, true);
-
     return i;
 }
 
@@ -970,11 +1023,10 @@ function rstring_replace_g(i) {
 
     assertEq(re.lastIndex == 0, true);
     var res = "str00123456789str00123456789".replace(re, "abc");
-    if (uceFault_string_replace_g(i) || uceFault_string_replace_g(i)) {
+    if (uceFault_string_replace_g(i) || uceFault_string_replace_g(i))
         assertEq(res, "abcabc");
-    }
+    assertRecoveredOnBailout(res, false);
     assertEq(re.lastIndex == 0, true);
-
     return i;
 }
 
@@ -989,10 +1041,9 @@ function rtypeof(i) {
     var x = typeof (inputs[i % inputs.length]);
     var y = types[i % types.length];
 
-    if (uceFault_typeof(i) || uceFault_typeof(i)) {
+    if (uceFault_typeof(i) || uceFault_typeof(i))
         assertEq(x, y);
-    }
-
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -1003,10 +1054,9 @@ function rtodouble_value(i) {
 
     var x = a < 8.1;
 
-    if (uceFault_todouble_value(i) || uceFault_todouble_value(i)) {
+    if (uceFault_todouble_value(i) || uceFault_todouble_value(i))
         assertEq(x, true);
-    }
-
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -1015,6 +1065,7 @@ function rtodouble_number(i) {
     var x = Math.fround(Math.fround(i) + Math.fround(i)) + 1;
     if (uceFault_todouble_number(i) || uceFault_todouble_number(i))
         assertEq(2 * i + 1, x);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -1023,6 +1074,7 @@ function rtofloat32_number(i) {
     var x = Math.fround(i + 0.1111111111);
     if (uceFault_tofloat32_number(i) || uceFault_tofloat32_number(i))
         assertEq(x, Math.fround(99.1111111111));
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -1034,6 +1086,7 @@ function rtofloat32_object(i) {
     t = 1000.1111111111;
     if (uceFault_tofloat32_object(i) || uceFault_tofloat32_object(i))
         assertEq(x, Math.fround(99.1111111111));
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -1042,6 +1095,7 @@ function rtrunc_to_int32_number(i) {
     var x = (i + 0.12) | 0;
     if (uceFault_trunc_to_int32_number(i) || uceFault_trunc_to_int32_number(i))
         assertEq(x, (i + 0.12) | 0);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -1053,6 +1107,7 @@ function rtrunc_to_int32_object(i) {
     t1 = 777.12;
     if (uceFault_trunc_to_int32_object(i) || uceFault_trunc_to_int32_object(i))
         assertEq(x, (i + 0.12) | 0);
+    assertRecoveredOnBailout(x, false);
 }
 
 var uceFault_trunc_to_int32_string = eval(uneval(uceFault).replace('uceFault', 'uceFault_trunc_to_int32_string'));
@@ -1060,6 +1115,7 @@ function rtrunc_to_int32_string(i) {
     var x = (i + "0") | 0;
     if (uceFault_trunc_to_int32_string(i) || uceFault_trunc_to_int32_string(i))
         assertEq(x, (i + "0") | 0);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -1068,6 +1124,7 @@ function rhypot_number_2args(i) {
     var x = Math.hypot(i, i + 1);
     if (uceFault_hypot_number_2args(i) || uceFault_hypot_number_2args(i))
         assertEq(x, Math.sqrt(i * i + (i + 1) * (i + 1)));
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -1076,6 +1133,7 @@ function rhypot_number_3args(i) {
     var x = Math.hypot(i, i + 1, i + 2);
     if (uceFault_hypot_number_3args(i) || uceFault_hypot_number_3args(i))
         assertEq(x, Math.sqrt(i * i + (i + 1) * (i + 1) + (i + 2) * (i + 2)));
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -1084,6 +1142,7 @@ function rhypot_number_4args(i) {
     var x = Math.hypot(i, i + 1, i + 2, i + 3);
     if (uceFault_hypot_number_4args(i) || uceFault_hypot_number_4args(i))
         assertEq(x, Math.sqrt(i * i + (i + 1) * (i + 1) + (i + 2) * (i + 2) + (i + 3) * (i + 3)));
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -1098,6 +1157,7 @@ function rhypot_object_2args(i) {
     t1 = 2000;
     if (uceFault_hypot_object_2args(i) || uceFault_hypot_object_2args(i) )
         assertEq(x, Math.sqrt(i * i + (i + 1) * (i + 1)));
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -1115,6 +1175,7 @@ function rhypot_object_3args(i) {
     t2 = 3000;
     if (uceFault_hypot_object_3args(i) || uceFault_hypot_object_3args(i) )
         assertEq(x, Math.sqrt(i * i + (i + 1) * (i + 1) + (i + 2) * (i + 2)));
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -1135,6 +1196,7 @@ function rhypot_object_4args(i) {
     t3 = 4000;
     if (uceFault_hypot_object_4args(i) || uceFault_hypot_object_4args(i) )
         assertEq(x, Math.sqrt(i * i + (i + 1) * (i + 1) + (i + 2) * (i + 2) + (i + 3) * (i + 3)));
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -1143,6 +1205,7 @@ function rsin_number(i) {
     var x = Math.sin(i);
     if (uceFault_sin_number(i) || uceFault_sin_number(i))
         assertEq(x, Math.sin(i));
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -1154,6 +1217,7 @@ function rsin_object(i) {
     t = 777;
     if (uceFault_sin_object(i) || uceFault_sin_object(i))
         assertEq(x, Math.sin(i));
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 
@@ -1162,6 +1226,7 @@ function rlog_number(i) {
     var x = Math.log(i);
     if (uceFault_log_number(i) || uceFault_log_number(i))
         assertEq(x, Math.log(99) /* log(99) */);
+    assertRecoveredOnBailout(x, true);
     return i;
 }
 
@@ -1173,6 +1238,7 @@ function rlog_object(i) {
     t = 1000;
     if (uceFault_log_object(i) || uceFault_log_object(i))
         assertEq(x, Math.log(99) /* log(99) */);
+    assertRecoveredOnBailout(x, false);
     return i;
 }
 

js/src/jit/MCallOptimize.cpp

@@ -2584,7 +2584,8 @@ IonBuilder::inlineTrue(CallInfo &callInfo)
 IonBuilder::InliningStatus
 IonBuilder::inlineAssertFloat32(CallInfo &callInfo)
 {
-    callInfo.setImplicitlyUsedUnchecked();
+    if (callInfo.argc() != 2)
+        return InliningStatus_NotInlined;
 
     MDefinition *secondArg = callInfo.getArg(1);
 
@@ -2597,12 +2598,16 @@ IonBuilder::inlineAssertFloat32(CallInfo &callInfo)
     MConstant *undefined = MConstant::New(alloc(), UndefinedValue());
     current->add(undefined);
     current->push(undefined);
+    callInfo.setImplicitlyUsedUnchecked();
     return InliningStatus_Inlined;
 }
 
 IonBuilder::InliningStatus
 IonBuilder::inlineAssertRecoveredOnBailout(CallInfo &callInfo)
 {
+    if (callInfo.argc() != 2)
+        return InliningStatus_NotInlined;
+
     if (js_JitOptions.checkRangeAnalysis) {
         // If we are checking the range of all instructions, then the guards
         // inserted by Range Analysis prevent the use of recover
@@ -2612,8 +2617,14 @@ IonBuilder::inlineAssertRecoveredOnBailout(CallInfo &callInfo)
         return InliningStatus_Inlined;
     }
 
+    MDefinition *secondArg = callInfo.getArg(1);
+
+    MOZ_ASSERT(secondArg->type() == MIRType_Boolean);
+    MOZ_ASSERT(secondArg->isConstantValue());
+
+    bool mustBeRecovered = secondArg->constantValue().toBoolean();
     MAssertRecoveredOnBailout *assert =
-        MAssertRecoveredOnBailout::New(alloc(), callInfo.getArg(0));
+        MAssertRecoveredOnBailout::New(alloc(), callInfo.getArg(0), mustBeRecovered);
     current->add(assert);
     current->push(assert);
 

js/src/jit/MIR.h

@@ -3907,8 +3907,10 @@ class MAssertRecoveredOnBailout
     public NoTypePolicy::Data
 {
   protected:
-    MAssertRecoveredOnBailout(MDefinition *ins)
-      : MUnaryInstruction(ins)
+    bool mustBeRecovered_;
+
+    MAssertRecoveredOnBailout(MDefinition *ins, bool mustBeRecovered)
+      : MUnaryInstruction(ins), mustBeRecovered_(mustBeRecovered)
     {
         setResultType(MIRType_Value);
         setRecoveredOnBailout();
@@ -3918,8 +3920,10 @@ class MAssertRecoveredOnBailout
   public:
     INSTRUCTION_HEADER(AssertRecoveredOnBailout)
 
-    static MAssertRecoveredOnBailout *New(TempAllocator &alloc, MDefinition *ins) {
-        return new(alloc) MAssertRecoveredOnBailout(ins);
+    static MAssertRecoveredOnBailout *New(TempAllocator &alloc, MDefinition *ins,
+                                          bool mustBeRecovered)
+    {
+        return new(alloc) MAssertRecoveredOnBailout(ins, mustBeRecovered);
     }
 
     // Needed to assert that float32 instructions are correctly recovered.

js/src/jit/Recover.cpp

@@ -1435,7 +1435,8 @@ bool
 MAssertRecoveredOnBailout::writeRecoverData(CompactBufferWriter &writer) const
 {
     MOZ_ASSERT(canRecoverOnBailout());
-    MOZ_ASSERT(input()->canRecoverOnBailout());
+    MOZ_RELEASE_ASSERT(input()->isRecoveredOnBailout() == mustBeRecovered_,
+        "assertRecoveredOnBailout failed during compilation");
     writer.writeUnsigned(uint32_t(RInstruction::Recover_AssertRecoveredOnBailout));
     return true;
 }

js/src/shell/js.cpp

@@ -4889,7 +4889,7 @@ static const JSFunctionSpecWithHelp fuzzing_unsafe_functions[] = {
 "assertFloat32(value, isFloat32)",
 "  In IonMonkey only, asserts that value has (resp. hasn't) the MIRType_Float32 if isFloat32 is true (resp. false)."),
 
-    JS_FN_HELP("assertRecoveredOnBailout", testingFunc_assertRecoveredOnBailout, 1, 0,
+    JS_FN_HELP("assertRecoveredOnBailout", testingFunc_assertRecoveredOnBailout, 2, 0,
 "assertRecoveredOnBailout(var)",
 "  In IonMonkey only, asserts that variable has RecoveredOnBailout flag."),