Bug 1008707: Implemented BitOr recover operation; r=bbouvier

js/src/jit-test/tests/ion/dce-with-rinstructions.js

@@ -31,6 +31,25 @@ function rbitnot_object(i) {
     return i;
 }
 
+var uceFault_bitor_number = eval(uneval(uceFault).replace('uceFault', 'uceFault_bitor_number'));
+function rbitor_number(i) {
+    var x = i | -100; /* -100 == ~99 */
+    if (uceFault_bitor_number(i) || uceFault_bitor_number(i))
+        assertEq(x, -1) /* ~99 | 99 = -1 */
+    return i;
+}
+
+var uceFault_bitor_object = eval(uneval(uceFault).replace('uceFault', 'uceFault_bitor_object'));
+function rbitor_object(i) {
+    var t = i;
+    var o = { valueOf: function() { return t; } };
+    var x = o | -100;
+    t = 1000;
+    if (uceFault_bitor_object(i) || uceFault_bitor_object(i))
+        assertEq(x, -1);
+    return i;
+}
+
 var uceFault_add_number = eval(uneval(uceFault).replace('uceFault', 'uceFault_add_number'));
 function radd_number(i) {
     var x = 1 + i;
@@ -71,6 +90,8 @@ function radd_object(i) {
 for (i = 0; i < 100; i++) {
     rbitnot_number(i);
     rbitnot_object(i);
+    rbitor_number(i);
+    rbitor_object(i);
     radd_number(i);
     radd_float(i);
     radd_string(i);

js/src/jit/MIR.h

@@ -3508,6 +3508,10 @@ class MBitOr : public MBinaryBitwiseInstruction
         return getOperand(0); // x | x => x
     }
     void computeRange(TempAllocator &alloc);
+    bool writeRecoverData(CompactBufferWriter &writer) const;
+    bool canRecoverOnBailout() const {
+        return specialization_ != MIRType_None;
+    }
 };
 
 class MBitXor : public MBinaryBitwiseInstruction

js/src/jit/Recover.cpp

@@ -258,3 +258,30 @@ RNewDerivedTypedObject::recover(JSContext *cx, SnapshotIterator &iter) const
     iter.storeInstructionResult(result);
     return true;
 }
+
+bool
+MBitOr::writeRecoverData(CompactBufferWriter &writer) const
+{
+    MOZ_ASSERT(canRecoverOnBailout());
+    writer.writeUnsigned(uint32_t(RInstruction::Recover_BitOr));
+    return true;
+}
+
+RBitOr::RBitOr(CompactBufferReader &reader)
+{}
+
+bool
+RBitOr::recover(JSContext *cx, SnapshotIterator &iter) const
+{
+    RootedValue lhs(cx, iter.read());
+    RootedValue rhs(cx, iter.read());
+    int32_t result;
+    MOZ_ASSERT(!lhs.isObject() && !rhs.isObject());
+
+    if (!js::BitOr(cx, lhs, rhs, &result))
+        return false;
+
+    RootedValue asValue(cx, js::Int32Value(result));
+    iter.storeInstructionResult(asValue);
+    return true;
+}

js/src/jit/Recover.h

@@ -19,6 +19,7 @@ namespace jit {
 #define RECOVER_OPCODE_LIST(_)                  \
     _(ResumePoint)                              \
     _(BitNot)                                   \
+    _(BitOr)                                    \
     _(Add)                                      \
     _(NewObject)                                \
     _(NewDerivedTypedObject)
@@ -143,6 +144,18 @@ class RNewDerivedTypedObject MOZ_FINAL : public RInstruction
     bool recover(JSContext *cx, SnapshotIterator &iter) const;
 };
 
+class RBitOr MOZ_FINAL : public RInstruction
+{
+  public:
+    RINSTRUCTION_HEADER_(BitOr)
+
+    virtual uint32_t numOperands() const {
+        return 2;
+    }
+
+    bool recover(JSContext *cx, SnapshotIterator &iter) const;
+};
+
 #undef RINSTRUCTION_HEADER_
 
 const RResumePoint *