Bug 935855 part 5. Use our members-in-slots information in ion codegen. r=efaust

js/src/jit/CodeGenerator.cpp

@@ -7367,6 +7367,22 @@ CodeGenerator::visitGetDOMProperty(LGetDOMProperty *ins)
     return true;
 }
 
+bool
+CodeGenerator::visitGetDOMMember(LGetDOMMember *ins)
+{
+    // It's simple to duplicate visitLoadFixedSlotV here than it is to try to
+    // use an LLoadFixedSlotV or some subclass of it for this case: that would
+    // require us to have MGetDOMMember inherit from MLoadFixedSlot, and then
+    // we'd have to duplicate a bunch of stuff we now get for free from
+    // MGetDOMProperty.
+    Register object = ToRegister(ins->object());
+    size_t slot = ins->mir()->domMemberSlotIndex();
+    ValueOperand result = GetValueOutput(ins);
+
+    masm.loadValue(Address(object, JSObject::getFixedSlotOffset(slot)), result);
+    return true;
+}
+
 bool
 CodeGenerator::visitSetDOMProperty(LSetDOMProperty *ins)
 {

js/src/jit/CodeGenerator.h

@@ -266,6 +266,7 @@ class CodeGenerator : public CodeGeneratorSpecific
     bool visitCallInstanceOf(LCallInstanceOf *ins);
     bool visitFunctionBoundary(LFunctionBoundary *lir);
     bool visitGetDOMProperty(LGetDOMProperty *lir);
+    bool visitGetDOMMember(LGetDOMMember *lir);
     bool visitSetDOMProperty(LSetDOMProperty *lir);
     bool visitCallDOMNative(LCallDOMNative *lir);
     bool visitCallGetIntrinsicValue(LCallGetIntrinsicValue *lir);

js/src/jit/IonBuilder.cpp

@@ -8417,7 +8417,14 @@ IonBuilder::getPropTryCommonGetter(bool *emitted, PropertyName *name,
 
     if (isDOM && testShouldDOMCall(objTypes, commonGetter, JSJitInfo::Getter)) {
         const JSJitInfo *jitinfo = commonGetter->jitInfo();
-        MGetDOMProperty *get = MGetDOMProperty::New(alloc(), jitinfo, obj, guard);
+        MInstruction *get;
+        if (jitinfo->isInSlot) {
+            // We can't use MLoadFixedSlot here because it might not have the
+            // right aliasing behavior; we want to alias DOM setters.
+            get = MGetDOMMember::New(alloc(), jitinfo, obj, guard);
+        } else {
+            get = MGetDOMProperty::New(alloc(), jitinfo, obj, guard);
+        }
         current->add(get);
         current->push(get);
 

js/src/jit/LIR-Common.h

@@ -1205,6 +1205,23 @@ class LGetDOMProperty : public LDOMPropertyInstructionHelper<BOX_PIECES, 0>
     }
 };
 
+class LGetDOMMember : public LInstructionHelper<BOX_PIECES, 1, 0>
+{
+  public:
+    LIR_HEADER(GetDOMMember);
+    LGetDOMMember(const LAllocation &object) {
+        setOperand(0, object);
+    }
+
+    const LAllocation *object() {
+        return getOperand(0);
+    }
+
+    MGetDOMMember *mir() const {
+        return mir_->toGetDOMMember();
+    }
+};
+
 class LSetDOMProperty : public LDOMPropertyInstructionHelper<0, BOX_PIECES>
 {
   public:

js/src/jit/LOpcodes.h

@@ -260,6 +260,7 @@
     _(InterruptCheckImplicit)       \
     _(FunctionBoundary)             \
     _(GetDOMProperty)               \
+    _(GetDOMMember)                 \
     _(SetDOMProperty)               \
     _(CallDOMNative)                \
     _(IsCallable)                   \

js/src/jit/Lowering.cpp

@@ -3372,6 +3372,15 @@ LIRGenerator::visitGetDOMProperty(MGetDOMProperty *ins)
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
+bool
+LIRGenerator::visitGetDOMMember(MGetDOMMember *ins)
+{
+    MOZ_ASSERT(ins->isDomPure(), "Members had better be pure");
+    LGetDOMMember *lir =
+        new LGetDOMMember(useRegister(ins->object()));
+    return defineBox(lir, ins);
+}
+
 static void
 SpewResumePoint(MBasicBlock *block, MInstruction *ins, MResumePoint *resumePoint)
 {

js/src/jit/Lowering.h

@@ -259,6 +259,7 @@ class LIRGenerator : public LIRGeneratorSpecific
     bool visitAsmJSCheckOverRecursed(MAsmJSCheckOverRecursed *ins);
     bool visitSetDOMProperty(MSetDOMProperty *ins);
     bool visitGetDOMProperty(MGetDOMProperty *ins);
+    bool visitGetDOMMember(MGetDOMMember *ins);
 };
 
 } // namespace jit

js/src/jit/MIR.h

@@ -7783,6 +7783,7 @@ class MGetDOMProperty
 {
     const JSJitInfo *info_;
 
+  protected:
     MGetDOMProperty(const JSJitInfo *jitinfo, MDefinition *obj, MDefinition *guard)
       : info_(jitinfo)
     {
@@ -7801,7 +7802,6 @@ class MGetDOMProperty
         setResultType(MIRType_Value);
     }
 
-  protected:
     const JSJitInfo *info() const {
         return info_;
     }
@@ -7827,6 +7827,10 @@ class MGetDOMProperty
     bool isDomPure() const {
         return info_->isPure;
     }
+    size_t domMemberSlotIndex() const {
+        MOZ_ASSERT(info_->isInSlot);
+        return info_->slotIndex;
+    }
     MDefinition *object() {
         return getOperand(0);
     }
@@ -7866,6 +7870,28 @@ class MGetDOMProperty
     }
 };
 
+class MGetDOMMember : public MGetDOMProperty
+{
+    // We inherit everything from MGetDOMProperty except our possiblyCalls value
+    MGetDOMMember(const JSJitInfo *jitinfo, MDefinition *obj, MDefinition *guard)
+        : MGetDOMProperty(jitinfo, obj, guard)
+    {
+    }
+
+  public:
+    INSTRUCTION_HEADER(GetDOMMember)
+
+    static MGetDOMMember *New(TempAllocator &alloc, const JSJitInfo *info, MDefinition *obj,
+                              MDefinition *guard)
+    {
+        return new(alloc) MGetDOMMember(info, obj, guard);
+    }
+
+    bool possiblyCalls() const {
+        return false;
+    }
+};
+
 class MStringLength
   : public MUnaryInstruction,
     public StringPolicy<0>

js/src/jit/MOpcodes.h

@@ -181,6 +181,7 @@ namespace jit {
     _(InterruptCheck)                                                       \
     _(FunctionBoundary)                                                     \
     _(GetDOMProperty)                                                       \
+    _(GetDOMMember)                                                         \
     _(SetDOMProperty)                                                       \
     _(IsCallable)                                                           \
     _(HaveSameClass)                                                        \

js/src/jit/ParallelSafetyAnalysis.cpp

@@ -274,6 +274,7 @@ class ParallelSafetyVisitor : public MInstructionVisitor
     SAFE_OP(AbortPar)
     UNSAFE_OP(ArrayConcat)
     UNSAFE_OP(GetDOMProperty)
+    UNSAFE_OP(GetDOMMember)
     UNSAFE_OP(SetDOMProperty)
     UNSAFE_OP(NewStringObject)
     UNSAFE_OP(Random)