Bug 1673553 part 85 - Remove JSOp::IterNext. r=iain

This was a hint for IonBuilder to prevent loop restarts. Although this still lets
us do an infallible unbox in Warp, there's not much of a perf improvement on a for-in
micro-benchmark so it's probably fine to remove this now.

Differential Revision: https://phabricator.services.mozilla.com/D98589

js/src/debugger/Script.cpp

@@ -1521,7 +1521,6 @@ static bool BytecodeIsEffectful(JSOp op) {
     case JSOp::TypeofExpr:
     case JSOp::ToAsyncIter:
     case JSOp::ToPropertyKey:
-    case JSOp::IterNext:
     case JSOp::Lambda:
     case JSOp::LambdaArrow:
     case JSOp::PushLexicalEnv:

js/src/frontend/ForInEmitter.cpp

@@ -93,11 +93,6 @@ bool ForInEmitter::emitInitialize() {
 #endif
   MOZ_ASSERT(loopDepth_ >= 2);
 
-  if (!bce_->emit1(JSOp::IterNext)) {
-    //              [stack] ITER ITERVAL
-    return false;
-  }
-
 #ifdef DEBUG
   state_ = State::Initialize;
 #endif

js/src/jit/BaselineCodeGen.cpp

@@ -1686,11 +1686,6 @@ bool BaselineCodeGen<Handler>::emit_Nop() {
   return true;
 }
 
-template <typename Handler>
-bool BaselineCodeGen<Handler>::emit_IterNext() {
-  return true;
-}
-
 template <typename Handler>
 bool BaselineCodeGen<Handler>::emit_NopDestructuring() {
   return true;

js/src/jit/WarpBuilder.cpp

@@ -1709,17 +1709,6 @@ bool WarpBuilder::build_Iter(BytecodeLocation loc) {
   return buildIC(loc, CacheKind::GetIterator, {obj});
 }
 
-bool WarpBuilder::build_IterNext(BytecodeLocation) {
-  // TODO(post-Warp): IterNext was added as hint to prevent IonBuilder/TI loop
-  // restarts. Once IonBuilder is gone this op should probably just be removed.
-  MDefinition* def = current->pop();
-  MInstruction* unbox =
-      MUnbox::New(alloc(), def, MIRType::String, MUnbox::Infallible);
-  current->add(unbox);
-  current->push(unbox);
-  return true;
-}
-
 bool WarpBuilder::build_MoreIter(BytecodeLocation loc) {
   MDefinition* iter = current->peek(-1);
   MInstruction* ins = MIteratorMore::New(alloc(), iter);

js/src/jit/WarpOracle.cpp

@@ -657,7 +657,6 @@ AbortReasonOr<WarpScriptSnapshot*> WarpScriptOracle::createScriptSnapshot() {
       case JSOp::SetAliasedVar:
       case JSOp::InitAliasedLexical:
       case JSOp::EnvCallee:
-      case JSOp::IterNext:
       case JSOp::MoreIter:
       case JSOp::EndIter:
       case JSOp::IsNoIter:

js/src/vm/BytecodeUtil.cpp

@@ -691,7 +691,6 @@ uint32_t BytecodeParser::simulateOp(JSOp op, uint32_t offset,
     case JSOp::SetIntrinsic:
     case JSOp::SetLocal:
     case JSOp::InitAliasedLexical:
-    case JSOp::IterNext:
     case JSOp::CheckLexical:
     case JSOp::CheckAliasedLexical:
       // Keep the top value.

js/src/vm/Interpreter.cpp

@@ -2510,12 +2510,6 @@ static MOZ_NEVER_INLINE JS_HAZ_JSNATIVE_CALLER bool Interpret(JSContext* cx,
     }
     END_CASE(IsGenClosing)
 
-    CASE(IterNext) {
-      // Ion relies on this.
-      MOZ_ASSERT(REGS.sp[-1].isString());
-    }
-    END_CASE(IterNext)
-
     CASE(Dup) {
       MOZ_ASSERT(REGS.stackDepth() >= 1);
       const Value& rref = REGS.sp[-1];

js/src/vm/Opcodes.h

@@ -1339,16 +1339,6 @@
      *   Stack: val => val, done
      */ \
     MACRO(IsNoIter, is_no_iter, NULL, 1, 1, 2, JOF_BYTE) \
-    /*
-     * No-op instruction to hint to IonBuilder that the value on top of the
-     * stack is the string key in a for-in loop.
-     *
-     *   Category: Objects
-     *   Type: Enumeration
-     *   Operands:
-     *   Stack: val => val
-     */ \
-    MACRO(IterNext, iter_next, NULL, 1, 1, 1, JOF_BYTE) \
     /*
      * Exit a for-in loop, closing the iterator.
      *
@@ -3574,6 +3564,7 @@
  * a power of two.  Use this macro to do so.
  */
 #define FOR_EACH_TRAILING_UNUSED_OPCODE(MACRO) \
+  MACRO(229)                                   \
   MACRO(230)                                   \
   MACRO(231)                                   \
   MACRO(232)                                   \