Backed out changeset 4be734a14524 (bug 887016)

js/src/jit-test/tests/ion/testObjectHasPrototype.js

@@ -1,63 +0,0 @@
-setJitCompilerOption("ion.warmup.trigger", 4);
-
-var ObjectHasPrototype = getSelfHostedValue("ObjectHasPrototype");
-
-var StringProto = String.prototype;
-var ObjectProto = Object.prototype;
-
-function testBasic() {
-  var f = function() {
-    assertEq(ObjectHasPrototype(StringProto, ObjectProto), true);
-  };
-  for (var i = 0; i < 40; i++) {
-    f();
-  }
-}
-testBasic();
-
-function testProtoChange(proto) {
-  var f = function(expected) {
-    assertEq(ObjectHasPrototype(StringProto, ObjectProto), expected);
-  };
-  var expected = true;
-  for (var i = 0; i < 120; i++) {
-    f(expected);
-    if (i == 40) {
-      Object.setPrototypeOf(StringProto, proto);
-      expected = false;
-    }
-    if (i == 80) {
-      Object.setPrototypeOf(StringProto, ObjectProto);
-      expected = true;
-    }
-  }
-}
-testProtoChange(null);
-// Different singleton
-testProtoChange(Function.prototype);
-// native non-singleton
-testProtoChange(/a/);
-// non-native non-singleton
-testProtoChange({});
-
-var Int32ArrayProto = Int32Array.prototype;
-var TypedArrayProto = Object.getPrototypeOf(Int32ArrayProto);
-function testProtoProtoChange(proto) {
-  var f = function() {
-    assertEq(ObjectHasPrototype(Int32ArrayProto, TypedArrayProto), true);
-  };
-  for (var i = 0; i < 120; i++) {
-    f();
-    if (i == 40)
-      Object.setPrototypeOf(TypedArrayProto, proto);
-    if (i == 80)
-      Object.setPrototypeOf(TypedArrayProto, Object);
-  }
-}
-testProtoProtoChange(null);
-// Different singleton
-testProtoProtoChange(Function.prototype);
-// native non-singleton
-testProtoProtoChange(/a/);
-// non-native non-singleton
-testProtoProtoChange({});

js/src/jit/InlinableNatives.h

@@ -106,7 +106,6 @@
     _(IntrinsicIsConstructing)      \
     _(IntrinsicSubstringKernel)     \
     _(IntrinsicDefineDataProperty)  \
-    _(IntrinsicObjectHasPrototype)  \
                                     \
     _(IntrinsicIsArrayIterator)     \
     _(IntrinsicIsMapIterator)       \

js/src/jit/IonBuilder.h

@@ -922,7 +922,6 @@ class IonBuilder
                                   const Class* clasp4 = nullptr);
     InliningStatus inlineIsConstructing(CallInfo& callInfo);
     InliningStatus inlineSubstringKernel(CallInfo& callInfo);
-    InliningStatus inlineObjectHasPrototype(CallInfo& callInfo);
 
     // Testing functions.
     InliningStatus inlineBailout(CallInfo& callInfo);

js/src/jit/MCallOptimize.cpp

@@ -5,7 +5,6 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "jsmath.h"
-#include "jsobj.h"
 #include "jsstr.h"
 
 #include "builtin/AtomicsObject.h"
@@ -267,8 +266,6 @@ IonBuilder::inlineNativeCall(CallInfo& callInfo, JSFunction* target)
         return inlineHasClass(callInfo, &ListIteratorObject::class_);
       case InlinableNative::IntrinsicDefineDataProperty:
         return inlineDefineDataProperty(callInfo);
-      case InlinableNative::IntrinsicObjectHasPrototype:
-        return inlineObjectHasPrototype(callInfo);
 
       // Map intrinsics.
       case InlinableNative::IntrinsicGetNextMapEntryForIterator:
@@ -1616,58 +1613,6 @@ IonBuilder::inlineStringSplit(CallInfo& callInfo)
     return InliningStatus_Inlined;
 }
 
-IonBuilder::InliningStatus
-IonBuilder::inlineObjectHasPrototype(CallInfo& callInfo)
-{
-    if (callInfo.argc() != 2 || callInfo.constructing()) {
-        trackOptimizationOutcome(TrackedOutcome::CantInlineNativeBadForm);
-        return InliningStatus_NotInlined;
-    }
-
-    MDefinition* objArg = callInfo.getArg(0);
-    MDefinition* protoArg = callInfo.getArg(1);
-
-    if (objArg->type() != MIRType_Object)
-        return InliningStatus_NotInlined;
-    if (protoArg->type() != MIRType_Object)
-        return InliningStatus_NotInlined;
-
-    // Inline only when both obj and proto are singleton objects and
-    // obj does not have uncacheable proto and obj.__proto__ is proto.
-    TemporaryTypeSet* objTypes = objArg->resultTypeSet();
-    if (!objTypes || objTypes->unknownObject() || objTypes->getObjectCount() != 1)
-        return InliningStatus_NotInlined;
-
-    TypeSet::ObjectKey* objKey = objTypes->getObject(0);
-    if (!objKey || !objKey->hasStableClassAndProto(constraints()))
-        return InliningStatus_NotInlined;
-    if (!objKey->isSingleton() || !objKey->singleton()->is<NativeObject>())
-        return InliningStatus_NotInlined;
-
-    JSObject* obj = &objKey->singleton()->as<NativeObject>();
-    if (obj->hasUncacheableProto())
-        return InliningStatus_NotInlined;
-
-    JSObject* actualProto = checkNurseryObject(objKey->proto().toObjectOrNull());
-    if (actualProto == nullptr)
-        return InliningStatus_NotInlined;
-
-    TemporaryTypeSet* protoTypes = protoArg->resultTypeSet();
-    if (!protoTypes || protoTypes->unknownObject() || protoTypes->getObjectCount() != 1)
-        return InliningStatus_NotInlined;
-
-    TypeSet::ObjectKey* protoKey = protoTypes->getObject(0);
-    if (!protoKey || !protoKey->hasStableClassAndProto(constraints()))
-        return InliningStatus_NotInlined;
-    if (!protoKey->isSingleton() || !protoKey->singleton()->is<NativeObject>())
-        return InliningStatus_NotInlined;
-
-    JSObject* proto = &protoKey->singleton()->as<NativeObject>();
-    pushConstant(BooleanValue(proto == actualProto));
-    callInfo.setImplicitlyUsedUnchecked();
-    return InliningStatus_Inlined;
-}
-
 IonBuilder::InliningStatus
 IonBuilder::inlineStrCharCodeAt(CallInfo& callInfo)
 {

js/src/vm/SelfHosting.cpp

@@ -585,22 +585,6 @@ intrinsic_DefineDataProperty(JSContext* cx, unsigned argc, Value* vp)
     return true;
 }
 
-static bool
-intrinsic_ObjectHasPrototype(JSContext* cx, unsigned argc, Value* vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-    MOZ_ASSERT(args.length() == 2);
-    RootedObject obj(cx, &args[0].toObject());
-    RootedObject proto(cx, &args[1].toObject());
-
-    RootedObject actualProto(cx);
-    if (!GetPrototype(cx, obj, &actualProto))
-        return false;
-
-    args.rval().setBoolean(actualProto == proto);
-    return true;
-}
-
 static bool
 intrinsic_UnsafeSetReservedSlot(JSContext* cx, unsigned argc, Value* vp)
 {
@@ -2191,8 +2175,6 @@ static const JSFunctionSpec intrinsic_functions[] = {
                     IntrinsicSubstringKernel),
     JS_INLINABLE_FN("_DefineDataProperty",              intrinsic_DefineDataProperty,      4,0,
                     IntrinsicDefineDataProperty),
-    JS_INLINABLE_FN("ObjectHasPrototype",               intrinsic_ObjectHasPrototype,      2,0,
-                    IntrinsicObjectHasPrototype),
     JS_INLINABLE_FN("UnsafeSetReservedSlot",            intrinsic_UnsafeSetReservedSlot,   3,0,
                     IntrinsicUnsafeSetReservedSlot),
     JS_INLINABLE_FN("UnsafeGetReservedSlot",            intrinsic_UnsafeGetReservedSlot,   2,0,