Bug 1822966 - Fix MConstantProto hashtable issues r=iain

Differential Revision: https://phabricator.services.mozilla.com/D173990

js/src/jit-test/tests/ion/bug1822966.js

@@ -0,0 +1,22 @@
+// |jit-test| --no-threads
+
+function bar() { return Math; }
+
+function foo() {
+    for (var i = 0; i < 50; i++) {
+      const arr = [1];
+      const arr2 = [1];
+      arr.h = 2;
+      for (var j = 0; j < 10; j++) {
+          for (var n = 0; n < 3000; n++) {}
+
+          for (var k = 0; k < 101; k++) {
+        bar();
+          }
+      }
+
+      arr.a = i;
+      arr2.x = 1;
+    }
+}
+foo()

js/src/jit/MIR.cpp

@@ -1169,10 +1169,13 @@ HashNumber MConstant::valueHash() const {
   return ConstantValueHash(type(), payload_.asBits);
 }
 
-// We will in theory get some extra collisions here, but dealing with those
-// should be cheaper than doing the skipObjectGuards for the receiver object.
 HashNumber MConstantProto::valueHash() const {
-  return protoObject()->valueHash();
+  HashNumber hash = protoObject()->valueHash();
+  const MDefinition* receiverObject = getReceiverObject();
+  if (receiverObject) {
+    hash = addU32ToHash(hash, receiverObject->id());
+  }
+  return hash;
 }
 
 bool MConstant::congruentTo(const MDefinition* ins) const {

js/src/jit/MIR.h

@@ -9210,9 +9210,10 @@ class MConstantProto : public MUnaryInstruction,
   // but instead just keep a pointer to it. This means we need to ensure it's
   // not discarded before we try to access it. If this is discarded, we
   // basically just become an MConstant for the object's proto, which is fine.
-  MDefinition* receiverObject_;
+  const MDefinition* receiverObject_;
 
-  explicit MConstantProto(MDefinition* protoObject, MDefinition* receiverObject)
+  explicit MConstantProto(MDefinition* protoObject,
+                          const MDefinition* receiverObject)
       : MUnaryInstruction(classOpcode, protoObject),
         receiverObject_(receiverObject) {
     MOZ_ASSERT(protoObject->isConstant());
@@ -9244,7 +9245,7 @@ class MConstantProto : public MUnaryInstruction,
     if (receiverObject_->isDiscarded()) {
       return nullptr;
     }
-    return receiverObject_->skipObjectGuards();
+    return receiverObject_;
   }
 };
 

js/src/jit/WarpCacheIRTranspiler.cpp

@@ -1511,7 +1511,7 @@ bool WarpCacheIRTranspiler::emitLoadProtoObject(ObjOperandId resultId,
   if (ins->isConstant()) {
     MDefinition* receiverObj = getOperand(receiverObjId);
 
-    ins = MConstantProto::New(alloc(), ins, receiverObj);
+    ins = MConstantProto::New(alloc(), ins, receiverObj->skipObjectGuards());
     add(ins);
   }
   return defineOperand(resultId, ins);