From f845777b8a05c92c1bba2c51718771299b85a68f Mon Sep 17 00:00:00 2001
From: Victor Carlquist <victorcarlquist@gmail.com>
Date: Thu, 5 Feb 2015 15:13:14 +0100
Subject: [PATCH] Bug 1127929 - IonMonkey: Inline SIMD.int32x4.and calls. r=nbp

---
 js/src/jit/BaselineIC.cpp    | 14 ++++++++------
 js/src/jit/IonBuilder.h      |  2 ++
 js/src/jit/MCallOptimize.cpp | 34 ++++++++++++++++++++++++++++++++++
 js/src/jit/MIR.h             | 12 +++++++++---
 4 files changed, 53 insertions(+), 9 deletions(-)

diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index 978f7e072a3d..0a55cabf4152 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -9108,12 +9108,14 @@ GetTemplateObjectForNative(JSContext *cx, HandleScript script, jsbytecode *pc,
         return true;
     }
 
-    if (native == js::simd_int32x4_add && JitSupportsSimd()) {
-        Rooted<TypeDescr *> descr(cx, &Int32x4::GetTypeDescr(*cx->global()));
-        res.set(TypedObject::createZeroed(cx, descr, 0, gc::TenuredHeap));
-        if (!res)
-            return false;
-        return true;
+    if (JitSupportsSimd()) {
+        if (native == js::simd_int32x4_add || native == js::simd_int32x4_and) {
+            Rooted<TypeDescr *> descr(cx, &Int32x4::GetTypeDescr(*cx->global()));
+            res.set(TypedObject::createZeroed(cx, descr, 0, gc::TenuredHeap));
+            if (!res)
+                return false;
+            return true;
+        }
     }
 
     return true;
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index 8ef0d0658b28..e71054cc2197 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -805,6 +805,8 @@ class IonBuilder
     InliningStatus inlineConstructSimdObject(CallInfo &callInfo, SimdTypeDescr *target);
     InliningStatus inlineSimdInt32x4BinaryArith(CallInfo &callInfo, JSNative native,
                                                 MSimdBinaryArith::Operation op);
+    InliningStatus inlineSimdInt32x4BinaryBitwise(CallInfo &callInfo, JSNative native,
+                                                  MSimdBinaryBitwise::Operation op);
 
     // Utility intrinsics.
     InliningStatus inlineIsCallable(CallInfo &callInfo);
diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
index 8f44052c567c..2a51d1d2e053 100644
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -259,6 +259,8 @@ IonBuilder::inlineNativeCall(CallInfo &callInfo, JSFunction *target)
     // Simd functions
     if (native == js::simd_int32x4_add)
         return inlineSimdInt32x4BinaryArith(callInfo, native, MSimdBinaryArith::Add);
+    if (native == js::simd_int32x4_and)
+        return inlineSimdInt32x4BinaryBitwise(callInfo, native, MSimdBinaryBitwise::and_);
 
     return InliningStatus_NotInlined;
 }
@@ -2757,5 +2759,37 @@ IonBuilder::inlineSimdInt32x4BinaryArith(CallInfo &callInfo, JSNative native,
     return InliningStatus_Inlined;
 }
 
+IonBuilder::InliningStatus
+IonBuilder::inlineSimdInt32x4BinaryBitwise(CallInfo &callInfo, JSNative native,
+                                           MSimdBinaryBitwise::Operation op)
+{
+    if (callInfo.argc() != 2)
+        return InliningStatus_NotInlined;
+
+    JSObject *templateObject = inspector->getTemplateObjectForNative(pc, native);
+    if (!templateObject)
+        return InliningStatus_NotInlined;
+
+    InlineTypedObject *inlineTypedObject = &templateObject->as<InlineTypedObject>();
+    MOZ_ASSERT(inlineTypedObject->typeDescr().as<SimdTypeDescr>().type() == js::Int32x4::type);
+
+    // If the type of any of the arguments is neither a SIMD type, an Object
+    // type, or a Value, then the applyTypes phase will add a fallible box &
+    // unbox sequence.  This does not matter much as the binary bitwise
+    // instruction is supposed to produce a TypeError once it is called.
+    MSimdBinaryBitwise *ins = MSimdBinaryBitwise::New(alloc(), callInfo.getArg(0), callInfo.getArg(1),
+                                                      op, MIRType_Int32x4);
+
+    MSimdBox *obj = MSimdBox::New(alloc(), constraints(), ins, inlineTypedObject,
+                                  inlineTypedObject->group()->initialHeap(constraints()));
+
+    current->add(ins);
+    current->add(obj);
+    current->push(obj);
+
+    callInfo.setImplicitlyUsedUnchecked();
+    return InliningStatus_Inlined;
+}
+
 } // namespace jit
 } // namespace js
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index e8f130639f11..2a914d98adcf 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -2029,7 +2029,7 @@ class MSimdBinaryArith
 
 class MSimdBinaryBitwise
   : public MBinaryInstruction,
-    public NoTypePolicy::Data
+    public MixPolicy<SimdSameAsReturnedTypePolicy<0>, SimdSameAsReturnedTypePolicy<1> >::Data
 {
   public:
     enum Operation {
@@ -2045,8 +2045,6 @@ class MSimdBinaryBitwise
       : MBinaryInstruction(left, right), operation_(op)
     {
         MOZ_ASSERT(IsSimdType(type));
-        MOZ_ASSERT(left->type() == right->type());
-        MOZ_ASSERT(left->type() == type);
         setResultType(type);
         setMovable();
         setCommutative();
@@ -2054,9 +2052,17 @@ class MSimdBinaryBitwise
 
   public:
     INSTRUCTION_HEADER(SimdBinaryBitwise)
+    static MSimdBinaryBitwise *New(TempAllocator &alloc, MDefinition *left, MDefinition *right,
+                                   Operation op, MIRType t)
+    {
+        return new(alloc) MSimdBinaryBitwise(left, right, op, t);
+    }
+
     static MSimdBinaryBitwise *NewAsmJS(TempAllocator &alloc, MDefinition *left,
                                         MDefinition *right, Operation op, MIRType t)
     {
+        MOZ_ASSERT(left->type() == right->type());
+        MOZ_ASSERT(left->type() == t);
         return new(alloc) MSimdBinaryBitwise(left, right, op, t);
     }