Bug 1850814 - Add post barrier fast path for last-buffered-cell also to Baseline and IC code. r=jonco

This lets us skip the call in BaselineCodeGen in ~70% of cases on Speedometer 3.
For IC code this is ~22%.

Differential Revision: https://phabricator.services.mozilla.com/D187136

js/src/jit/BaselineCodeGen.cpp

@@ -518,25 +518,26 @@ bool BaselineCodeGen<Handler>::emitOutOfLinePostBarrierSlot() {
 
   masm.bind(&postBarrierSlot_);
 
-  saveInterpreterPCReg();
+#ifdef JS_USE_LINK_REGISTER
+  masm.pushReturnAddress();
+#endif
 
   Register objReg = R2.scratchReg();
+
+  // Check one element cache to avoid VM call.
+  Label skipBarrier;
+  auto* lastCellAddr = cx->runtime()->gc.addressOfLastBufferedWholeCell();
+  masm.branchPtr(Assembler::Equal, AbsoluteAddress(lastCellAddr), objReg,
+                 &skipBarrier);
+
+  saveInterpreterPCReg();
+
   AllocatableGeneralRegisterSet regs(GeneralRegisterSet::All());
   MOZ_ASSERT(!regs.has(FramePointer));
   regs.take(R0);
   regs.take(objReg);
   Register scratch = regs.takeAny();
-#if defined(JS_CODEGEN_ARM) || defined(JS_CODEGEN_ARM64)
-  // On ARM, save the link register before calling.  It contains the return
-  // address.  The |masm.ret()| later will pop this into |pc| to return.
-  masm.push(lr);
-#elif defined(JS_CODEGEN_MIPS32) || defined(JS_CODEGEN_MIPS64)
-  masm.push(ra);
-#elif defined(JS_CODEGEN_LOONG64)
-  masm.push(ra);
-#elif defined(JS_CODEGEN_RISCV64)
-  masm.push(ra);
-#endif
+
   masm.pushValue(R0);
 
   using Fn = void (*)(JSRuntime* rt, js::gc::Cell* cell);
@@ -549,6 +550,8 @@ bool BaselineCodeGen<Handler>::emitOutOfLinePostBarrierSlot() {
   restoreInterpreterPCReg();
 
   masm.popValue(R0);
+
+  masm.bind(&skipBarrier);
   masm.ret();
   return true;
 }

js/src/jit/CacheIRCompiler.cpp

@@ -7238,6 +7238,11 @@ void CacheIRCompiler::emitPostBarrierShared(Register obj,
   }
   masm.branchPtrInNurseryChunk(Assembler::Equal, obj, scratch, &skipBarrier);
 
+  // Check one element cache to avoid VM call.
+  auto* lastCellAddr = cx_->runtime()->gc.addressOfLastBufferedWholeCell();
+  masm.branchPtr(Assembler::Equal, AbsoluteAddress(lastCellAddr), obj,
+                 &skipBarrier);
+
   // Call one of these, depending on maybeIndex:
   //
   //   void PostWriteBarrier(JSRuntime* rt, JSObject* obj);

js/src/jit/CodeGenerator.cpp

@@ -5052,9 +5052,9 @@ static void EmitPostWriteBarrier(MacroAssembler& masm, CompileRuntime* runtime,
                                       &exit, &callVM);
     } else {
       // Check one element cache to avoid VM call.
-      masm.loadPtr(AbsoluteAddress(runtime->addressOfLastBufferedWholeCell()),
-                   temp);
-      masm.branchPtr(Assembler::Equal, temp, objreg, &exit);
+      masm.branchPtr(Assembler::Equal,
+                     AbsoluteAddress(runtime->addressOfLastBufferedWholeCell()),
+                     objreg, &exit);
     }
   }