From c9638d4bc8b0fc059affe7f2de3d0e1dc5d72e04 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Fri, 2 Jan 2015 17:18:16 -0500
Subject: [PATCH] Bug 1112934.  Tell MGetDOMMember what its result type is so
 it can do a typed slot load.  r=jandem

---
 js/src/jit/CodeGenerator.cpp | 20 ++++++++++++++++++--
 js/src/jit/CodeGenerator.h   |  3 ++-
 js/src/jit/LIR-Common.h      | 23 ++++++++++++++++++++---
 js/src/jit/LOpcodes.h        |  3 ++-
 js/src/jit/Lowering.cpp      | 16 +++++++++++++---
 js/src/jit/MIR.h             |  1 +
 6 files changed, 56 insertions(+), 10 deletions(-)

diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 279b76fd7024..b29b3d9a35cd 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -9332,9 +9332,9 @@ CodeGenerator::visitGetDOMProperty(LGetDOMProperty *ins)
 }
 
 void
-CodeGenerator::visitGetDOMMember(LGetDOMMember *ins)
+CodeGenerator::visitGetDOMMemberV(LGetDOMMemberV *ins)
 {
-    // It's simple to duplicate visitLoadFixedSlotV here than it is to try to
+    // It's simpler to duplicate visitLoadFixedSlotV here than it is to try to
     // use an LLoadFixedSlotV or some subclass of it for this case: that would
     // require us to have MGetDOMMember inherit from MLoadFixedSlot, and then
     // we'd have to duplicate a bunch of stuff we now get for free from
@@ -9346,6 +9346,22 @@ CodeGenerator::visitGetDOMMember(LGetDOMMember *ins)
     masm.loadValue(Address(object, NativeObject::getFixedSlotOffset(slot)), result);
 }
 
+void
+CodeGenerator::visitGetDOMMemberT(LGetDOMMemberT *ins)
+{
+    // It's simpler to duplicate visitLoadFixedSlotT here than it is to try to
+    // use an LLoadFixedSlotT or some subclass of it for this case: that would
+    // require us to have MGetDOMMember inherit from MLoadFixedSlot, and then
+    // we'd have to duplicate a bunch of stuff we now get for free from
+    // MGetDOMProperty.
+    Register object = ToRegister(ins->object());
+    size_t slot = ins->mir()->domMemberSlotIndex();
+    AnyRegister result = ToAnyRegister(ins->getDef(0));
+    MIRType type = ins->mir()->type();
+
+    masm.loadUnboxedValue(Address(object, NativeObject::getFixedSlotOffset(slot)), type, result);
+}
+
 void
 CodeGenerator::visitSetDOMProperty(LSetDOMProperty *ins)
 {
diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
index 1d346fe3e2a3..e1a5d5be0132 100644
--- a/js/src/jit/CodeGenerator.h
+++ b/js/src/jit/CodeGenerator.h
@@ -305,7 +305,8 @@ class CodeGenerator : public CodeGeneratorSpecific
     void visitCallInstanceOf(LCallInstanceOf *ins);
     void visitProfilerStackOp(LProfilerStackOp *lir);
     void visitGetDOMProperty(LGetDOMProperty *lir);
-    void visitGetDOMMember(LGetDOMMember *lir);
+    void visitGetDOMMemberV(LGetDOMMemberV *lir);
+    void visitGetDOMMemberT(LGetDOMMemberT *lir);
     void visitSetDOMProperty(LSetDOMProperty *lir);
     void visitCallDOMNative(LCallDOMNative *lir);
     void visitCallGetIntrinsicValue(LCallGetIntrinsicValue *lir);
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index b73a9de8ffca..3420a8763296 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -1750,11 +1750,28 @@ class LGetDOMProperty : public LDOMPropertyInstructionHelper<BOX_PIECES, 0>
     }
 };
 
-class LGetDOMMember : public LInstructionHelper<BOX_PIECES, 1, 0>
+class LGetDOMMemberV : public LInstructionHelper<BOX_PIECES, 1, 0>
 {
   public:
-    LIR_HEADER(GetDOMMember);
-    explicit LGetDOMMember(const LAllocation &object) {
+    LIR_HEADER(GetDOMMemberV);
+    explicit LGetDOMMemberV(const LAllocation &object) {
+        setOperand(0, object);
+    }
+
+    const LAllocation *object() {
+        return getOperand(0);
+    }
+
+    MGetDOMMember *mir() const {
+        return mir_->toGetDOMMember();
+    }
+};
+
+class LGetDOMMemberT : public LInstructionHelper<1, 1, 0>
+{
+  public:
+    LIR_HEADER(GetDOMMemberT);
+    explicit LGetDOMMemberT(const LAllocation &object) {
         setOperand(0, object);
     }
 
diff --git a/js/src/jit/LOpcodes.h b/js/src/jit/LOpcodes.h
index 55bd732e8943..9b09b530db57 100644
--- a/js/src/jit/LOpcodes.h
+++ b/js/src/jit/LOpcodes.h
@@ -316,7 +316,8 @@
     _(InterruptCheckImplicit)       \
     _(ProfilerStackOp)              \
     _(GetDOMProperty)               \
-    _(GetDOMMember)                 \
+    _(GetDOMMemberV)                \
+    _(GetDOMMemberT)                \
     _(SetDOMProperty)               \
     _(CallDOMNative)                \
     _(IsCallable)                   \
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index d6f08c34aa16..f8bce867b79c 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -3824,9 +3824,19 @@ LIRGenerator::visitGetDOMMember(MGetDOMMember *ins)
     // value can in fact change as a result of DOM setters and method calls.
     MOZ_ASSERT(ins->domAliasSet() != JSJitInfo::AliasEverything,
                "Member gets had better not alias the world");
-    LGetDOMMember *lir =
-        new(alloc()) LGetDOMMember(useRegisterAtStart(ins->object()));
-    defineBox(lir, ins);
+
+    MDefinition *obj = ins->object();
+    MOZ_ASSERT(obj->type() == MIRType_Object);
+
+    MIRType type = ins->type();
+
+    if (type == MIRType_Value) {
+        LGetDOMMemberV *lir = new(alloc()) LGetDOMMemberV(useRegisterAtStart(obj));
+        defineBox(lir, ins);
+    } else {
+        LGetDOMMemberT *lir = new(alloc()) LGetDOMMemberT(useRegisterForTypedLoad(obj, type));
+        define(lir, ins);
+    }
 }
 
 void
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index b4c3e44b8b1e..1fde083aaba1 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -10644,6 +10644,7 @@ class MGetDOMMember : public MGetDOMProperty
     explicit MGetDOMMember(const JSJitInfo *jitinfo)
         : MGetDOMProperty(jitinfo)
     {
+        setResultType(MIRTypeFromValueType(jitinfo->returnType()));
     }
 
   public: