Bug 625701: Sensible fixed width branching. (r=cdleary)

js/src/assembler/assembler/MacroAssemblerARM.h

@@ -496,12 +496,17 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond), useConstantPool));
     }
 
-    Jump branch32_force32(Condition cond, RegisterID left, Imm32 right, int useConstantPool = 0)
+    // Like branch32, but emit a consistently-structured sequence such that the
+    // number of instructions emitted is constant, regardless of the argument
+    // values. For ARM, this is identical to branch32WithPatch, except that it
+    // does not generate a DataLabel32.
+    Jump branch32FixedLength(Condition cond, RegisterID left, Imm32 right)
     {
-        return branch32(cond, left, right, useConstantPool);
+        m_assembler.ldr_un_imm(ARMRegisters::S1, right.m_value);
+        return branch32(cond, left, ARMRegisters::S1, true);
     }
 
-    // As branch32, but allow the value ('right') to be patched.
+    // As branch32_force32, but allow the value ('right') to be patched.
     Jump branch32WithPatch(Condition cond, RegisterID left, Imm32 right, DataLabel32 &dataLabel)
     {
         ASSERT(left != ARMRegisters::S1);

js/src/assembler/assembler/MacroAssemblerX86Common.h

@@ -856,8 +856,9 @@ public:
     }
     
     // Branch based on a 32-bit comparison, forcing the size of the
-    // immediate operand to 32 bits in the native code stream.
-    Jump branch32_force32(Condition cond, RegisterID left, Imm32 right)
+    // immediate operand to 32 bits in the native code stream to ensure that
+    // the length of code emitted by this instruction is consistent.
+    Jump branch32FixedLength(Condition cond, RegisterID left, Imm32 right)
     {
         m_assembler.cmpl_ir_force32(right.m_value, left);
         return Jump(m_assembler.jCC(x86Condition(cond)));
@@ -867,7 +868,7 @@ public:
     Jump branch32WithPatch(Condition cond, RegisterID left, Imm32 right, DataLabel32 &dataLabel)
     {
         // Always use cmpl, since the value is to be patched.
-        m_assembler.cmpl_ir(right.m_value, left);
+        m_assembler.cmpl_ir_force32(right.m_value, left);
         dataLabel = DataLabel32(this);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }

js/src/methodjit/PolyIC.cpp

@@ -287,8 +287,8 @@ class SetPropCompiler : public PICStubCompiler
         }
 
         Label start = masm.label();
-        Jump shapeGuard = masm.branch32_force32(Assembler::NotEqual, pic.shapeReg,
-                                                Imm32(initialShape));
+        Jump shapeGuard = masm.branch32FixedLength(Assembler::NotEqual, pic.shapeReg,
+                                                   Imm32(initialShape));
 
         Label stubShapeJumpLabel = masm.label();
 
@@ -1055,8 +1055,8 @@ class GetPropCompiler : public PICStubCompiler
             }
 
             start = masm.label();
-            shapeGuardJump = masm.branch32_force32(Assembler::NotEqual, pic.shapeReg,
-                                                   Imm32(obj->shape()));
+            shapeGuardJump = masm.branch32FixedLength(Assembler::NotEqual, pic.shapeReg,
+                                                      Imm32(obj->shape()));
         }
         Label stubShapeJumpLabel = masm.label();