Bug 1112934. Tell MGetDOMMember what its result type is so it can do a typed slot load. r=jandem

js/src/jit/CodeGenerator.cpp

@@ -9332,9 +9332,9 @@ CodeGenerator::visitGetDOMProperty(LGetDOMProperty *ins)
 }
 
 void
-CodeGenerator::visitGetDOMMember(LGetDOMMember *ins)
+CodeGenerator::visitGetDOMMemberV(LGetDOMMemberV *ins)
 {
-    // It's simple to duplicate visitLoadFixedSlotV here than it is to try to
+    // It's simpler to duplicate visitLoadFixedSlotV here than it is to try to
     // use an LLoadFixedSlotV or some subclass of it for this case: that would
     // require us to have MGetDOMMember inherit from MLoadFixedSlot, and then
     // we'd have to duplicate a bunch of stuff we now get for free from
@@ -9346,6 +9346,22 @@ CodeGenerator::visitGetDOMMember(LGetDOMMember *ins)
     masm.loadValue(Address(object, NativeObject::getFixedSlotOffset(slot)), result);
 }
 
+void
+CodeGenerator::visitGetDOMMemberT(LGetDOMMemberT *ins)
+{
+    // It's simpler to duplicate visitLoadFixedSlotT here than it is to try to
+    // use an LLoadFixedSlotT or some subclass of it for this case: that would
+    // require us to have MGetDOMMember inherit from MLoadFixedSlot, and then
+    // we'd have to duplicate a bunch of stuff we now get for free from
+    // MGetDOMProperty.
+    Register object = ToRegister(ins->object());
+    size_t slot = ins->mir()->domMemberSlotIndex();
+    AnyRegister result = ToAnyRegister(ins->getDef(0));
+    MIRType type = ins->mir()->type();
+
+    masm.loadUnboxedValue(Address(object, NativeObject::getFixedSlotOffset(slot)), type, result);
+}
+
 void
 CodeGenerator::visitSetDOMProperty(LSetDOMProperty *ins)
 {

js/src/jit/CodeGenerator.h

@@ -305,7 +305,8 @@ class CodeGenerator : public CodeGeneratorSpecific
     void visitCallInstanceOf(LCallInstanceOf *ins);
     void visitProfilerStackOp(LProfilerStackOp *lir);
     void visitGetDOMProperty(LGetDOMProperty *lir);
-    void visitGetDOMMember(LGetDOMMember *lir);
+    void visitGetDOMMemberV(LGetDOMMemberV *lir);
+    void visitGetDOMMemberT(LGetDOMMemberT *lir);
     void visitSetDOMProperty(LSetDOMProperty *lir);
     void visitCallDOMNative(LCallDOMNative *lir);
     void visitCallGetIntrinsicValue(LCallGetIntrinsicValue *lir);

js/src/jit/LIR-Common.h

@@ -1750,11 +1750,28 @@ class LGetDOMProperty : public LDOMPropertyInstructionHelper<BOX_PIECES, 0>
     }
 };
 
-class LGetDOMMember : public LInstructionHelper<BOX_PIECES, 1, 0>
+class LGetDOMMemberV : public LInstructionHelper<BOX_PIECES, 1, 0>
 {
   public:
-    LIR_HEADER(GetDOMMember);
-    explicit LGetDOMMember(const LAllocation &object) {
+    LIR_HEADER(GetDOMMemberV);
+    explicit LGetDOMMemberV(const LAllocation &object) {
+        setOperand(0, object);
+    }
+
+    const LAllocation *object() {
+        return getOperand(0);
+    }
+
+    MGetDOMMember *mir() const {
+        return mir_->toGetDOMMember();
+    }
+};
+
+class LGetDOMMemberT : public LInstructionHelper<1, 1, 0>
+{
+  public:
+    LIR_HEADER(GetDOMMemberT);
+    explicit LGetDOMMemberT(const LAllocation &object) {
         setOperand(0, object);
     }
 

js/src/jit/LOpcodes.h

@@ -316,7 +316,8 @@
     _(InterruptCheckImplicit)       \
     _(ProfilerStackOp)              \
     _(GetDOMProperty)               \
-    _(GetDOMMember)                 \
+    _(GetDOMMemberV)                \
+    _(GetDOMMemberT)                \
     _(SetDOMProperty)               \
     _(CallDOMNative)                \
     _(IsCallable)                   \

js/src/jit/Lowering.cpp

@@ -3824,9 +3824,19 @@ LIRGenerator::visitGetDOMMember(MGetDOMMember *ins)
     // value can in fact change as a result of DOM setters and method calls.
     MOZ_ASSERT(ins->domAliasSet() != JSJitInfo::AliasEverything,
                "Member gets had better not alias the world");
-    LGetDOMMember *lir =
-        new(alloc()) LGetDOMMember(useRegisterAtStart(ins->object()));
-    defineBox(lir, ins);
+
+    MDefinition *obj = ins->object();
+    MOZ_ASSERT(obj->type() == MIRType_Object);
+
+    MIRType type = ins->type();
+
+    if (type == MIRType_Value) {
+        LGetDOMMemberV *lir = new(alloc()) LGetDOMMemberV(useRegisterAtStart(obj));
+        defineBox(lir, ins);
+    } else {
+        LGetDOMMemberT *lir = new(alloc()) LGetDOMMemberT(useRegisterForTypedLoad(obj, type));
+        define(lir, ins);
+    }
 }
 
 void

js/src/jit/MIR.h

@@ -10644,6 +10644,7 @@ class MGetDOMMember : public MGetDOMProperty
     explicit MGetDOMMember(const JSJitInfo *jitinfo)
         : MGetDOMProperty(jitinfo)
     {
+        setResultType(MIRTypeFromValueType(jitinfo->returnType()));
     }
 
   public: