Bug 1415772: Implement MNearbyInt recover instruction r=nbp

MozReview-Commit-ID: D7JdEHjDl2W

--HG--
extra : rebase_source : 987529027984eaf0ab54e056d2965743c6748c9b

js/src/jit-test/tests/ion/dce-with-rinstructions.js

@@ -495,6 +495,15 @@ function rfloor_object(i) {
     return i;
 }
 
+let uceFault_floor_double = eval(uneval(uceFault).replace('uceFault', 'uceFault_floor_double'));
+function rfloor_double(i) {
+    const x = Math.floor(i + (-1 >>> 0));
+    if (uceFault_floor_double(i) || uceFault_floor_double(i))
+        assertEq(x, 99 + (-1 >>> 0)); /* = i + 2 ^ 32 - 1 */
+    assertRecoveredOnBailout(x, true);
+    return i;
+}
+
 var uceFault_ceil_number = eval(uneval(uceFault).replace('uceFault', 'uceFault_ceil_number'));
 function rceil_number(i) {
     var x = Math.ceil(-i - 0.12010799100);
@@ -504,6 +513,15 @@ function rceil_number(i) {
     return i;
 }
 
+let uceFault_ceil_double = eval(uneval(uceFault).replace('uceFault', 'uceFault_ceil_double'));
+function rceil_double(i) {
+    const x = Math.floor(i + (-1 >>> 0));
+    if (uceFault_ceil_double(i) || uceFault_ceil_double(i))
+        assertEq(x, 99 + (-1 >>> 0)); /* = i + 2 ^ 32 - 1 */
+    assertRecoveredOnBailout(x, true);
+    return i;
+}
+
 var uceFault_round_number = eval(uneval(uceFault).replace('uceFault', 'uceFault_round'));
 function rround_number(i) {
     var x = Math.round(i + 1.4);
@@ -1391,8 +1409,10 @@ for (j = 100 - max; j < 100; j++) {
     rinline_arguments_length_1(i);
     rinline_arguments_length_3(i, 0, 1);
     rfloor_number(i);
+    rfloor_double(i);
     rfloor_object(i);
     rceil_number(i);
+    rceil_double(i);
     rround_number(i);
     rround_double(i);
     rcharCodeAt(i);

js/src/jit-test/tests/ion/rinstructions-no-sse4.js

@@ -18,6 +18,18 @@ let uceFault = function (i) {
     return false;
 };
 
+let uceFault_ceil_double = eval(
+    uneval(uceFault)
+        .replace('uceFault', 'uceFault_ceil_double')
+);
+function rceil_double(i) {
+    const x = Math.ceil(i + (-1 >>> 0));
+    if (uceFault_ceil_double(i) || uceFault_ceil_double(i))
+        assertEq(x, 99 + (-1 >>> 0)); /* = i + 2 ^ 32 - 1 */
+    assertRecoveredOnBailout(x, true);
+    return i;
+}
+
 let uceFault_floor_double = eval(
     uneval(uceFault)
         .replace('uceFault', 'uceFault_floor_double')
@@ -33,5 +45,6 @@ function rfloor_double(i) {
 for (let j = 100 - max; j < 100; j++) {
     with({}){} // Do not Ion-compile this loop.
     const i = j < 2 ? (Math.abs(j) % 50) + 2 : j;
+    rceil_double(i);
     rfloor_double(i);
 }

js/src/jit/MIR.h

@@ -7017,6 +7017,7 @@ class MMathFunction
         switch(function_) {
           case Sin:
           case Log:
+          case Ceil:
           case Floor:
           case Round:
             return true;
@@ -12623,6 +12624,18 @@ class MNearbyInt
 
     void printOpcode(GenericPrinter& out) const override;
 
+    MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override;
+
+    bool canRecoverOnBailout() const override {
+        switch (roundingMode_) {
+          case RoundingMode::Up:
+          case RoundingMode::Down:
+            return true;
+          default:
+            return false;
+        }
+    }
+
     ALLOW_CLONE(MNearbyInt)
 };
 

js/src/jit/Recover.cpp

@@ -957,11 +957,41 @@ RHypot::recover(JSContext* cx, SnapshotIterator& iter) const
     return true;
 }
 
+bool
+MNearbyInt::writeRecoverData(CompactBufferWriter& writer) const
+{
+    MOZ_ASSERT(canRecoverOnBailout());
+    switch (roundingMode_) {
+      case RoundingMode::Up:
+        writer.writeUnsigned(uint32_t(RInstruction::Recover_Ceil));
+        return true;
+      case RoundingMode::Down:
+        writer.writeUnsigned(uint32_t(RInstruction::Recover_Floor));
+        return true;
+      default:
+        MOZ_CRASH("Unsupported rounding mode.");
+    }
+}
+
+RNearbyInt::RNearbyInt(CompactBufferReader& reader)
+{
+    roundingMode_ = reader.readByte();
+}
+
+bool
+RNearbyInt::recover(JSContext* cx, SnapshotIterator& iter) const
+{
+    MOZ_CRASH("Unsupported rounding mode.");
+}
+
 bool
 MMathFunction::writeRecoverData(CompactBufferWriter& writer) const
 {
     MOZ_ASSERT(canRecoverOnBailout());
     switch (function_) {
+      case Ceil:
+        writer.writeUnsigned(uint32_t(RInstruction::Recover_Ceil));
+        return true;
       case Floor:
         writer.writeUnsigned(uint32_t(RInstruction::Recover_Floor));
         return true;

js/src/jit/Recover.h

@@ -87,6 +87,7 @@ namespace jit {
     _(Sqrt)                                     \
     _(Atan2)                                    \
     _(Hypot)                                    \
+    _(NearbyInt)                                \
     _(MathFunction)                             \
     _(Random)                                   \
     _(StringSplit)                              \
@@ -466,6 +467,17 @@ class RHypot final : public RInstruction
      MOZ_MUST_USE bool recover(JSContext* cx, SnapshotIterator& iter) const override;
 };
 
+class RNearbyInt final : public RInstruction
+{
+  private:
+    uint8_t roundingMode_;
+
+  public:
+    RINSTRUCTION_HEADER_NUM_OP_(NearbyInt, 1)
+
+    MOZ_MUST_USE bool recover(JSContext* cx, SnapshotIterator& iter) const override;
+};
+
 class RMathFunction final : public RInstruction
 {
   private: