Bug 861116: IonBuilder: Add support for JSOP_INITELEM, r=jandem

js/src/ion/CodeGenerator.cpp

@@ -2648,11 +2648,6 @@ CodeGenerator::visitNewStringObject(LNewStringObject *lir)
     return true;
 }
 
-typedef bool(*InitPropFn)(JSContext *cx, HandleObject obj,
-                          HandlePropertyName name, HandleValue value);
-static const VMFunction InitPropInfo =
-    FunctionInfo<InitPropFn>(InitProp);
-
 bool
 CodeGenerator::visitParNew(LParNew *lir)
 {
@@ -2747,6 +2742,28 @@ CodeGenerator::visitParBailout(LParBailout *lir)
     return true;
 }
 
+typedef bool(*InitElemFn)(JSContext *cx, HandleObject obj,
+                          HandleValue id, HandleValue value);
+static const VMFunction InitElemInfo =
+    FunctionInfo<InitElemFn>(InitElemOperation);
+
+bool
+CodeGenerator::visitInitElem(LInitElem *lir)
+{
+    Register objReg = ToRegister(lir->getObject());
+
+    pushArg(ToValue(lir, LInitElem::ValueIndex));
+    pushArg(ToValue(lir, LInitElem::IdIndex));
+    pushArg(objReg);
+
+    return callVM(InitElemInfo, lir);
+}
+
+typedef bool(*InitPropFn)(JSContext *cx, HandleObject obj,
+                          HandlePropertyName name, HandleValue value);
+static const VMFunction InitPropInfo =
+    FunctionInfo<InitPropFn>(InitProp);
+
 bool
 CodeGenerator::visitInitProp(LInitProp *lir)
 {

js/src/ion/CodeGenerator.h

@@ -116,6 +116,7 @@ class CodeGenerator : public CodeGeneratorSpecific
     bool visitParNew(LParNew *lir);
     bool visitParNewDenseArray(LParNewDenseArray *lir);
     bool visitParBailout(LParBailout *lir);
+    bool visitInitElem(LInitElem *lir);
     bool visitInitProp(LInitProp *lir);
     bool visitCreateThis(LCreateThis *lir);
     bool visitCreateThisWithProto(LCreateThisWithProto *lir);

js/src/ion/IonBuilder.cpp

@@ -952,6 +952,9 @@ IonBuilder::inspectOpcode(JSOp op)
         return jsop_newobject(baseObj);
       }
 
+      case JSOP_INITELEM:
+        return jsop_initelem();
+
       case JSOP_INITELEM_ARRAY:
         return jsop_initelem_array();
 
@@ -4779,6 +4782,19 @@ IonBuilder::jsop_newobject(HandleObject baseObj)
     return resumeAfter(ins);
 }
 
+bool
+IonBuilder::jsop_initelem()
+{
+    MDefinition *value = current->pop();
+    MDefinition *id = current->pop();
+    MDefinition *obj = current->peek(-1);
+
+    MInitElem *initElem = MInitElem::New(obj, id, value);
+    current->add(initElem);
+
+    return resumeAfter(initElem);
+}
+
 bool
 IonBuilder::jsop_initelem_array()
 {

js/src/ion/IonBuilder.h

@@ -375,6 +375,7 @@ class IonBuilder : public MIRGenerator
     bool jsop_delprop(HandlePropertyName name);
     bool jsop_newarray(uint32_t count);
     bool jsop_newobject(HandleObject baseObj);
+    bool jsop_initelem();
     bool jsop_initelem_array();
     bool jsop_initprop(HandlePropertyName name);
     bool jsop_regexp(RegExpObject *reobj);

js/src/ion/LIR-Common.h

@@ -478,6 +478,26 @@ class LParBailout : public LInstructionHelper<0, 0, 0>
     LIR_HEADER(ParBailout);
 };
 
+class LInitElem : public LCallInstructionHelper<0, 1 + 2*BOX_PIECES, 0>
+{
+  public:
+    LIR_HEADER(InitElem)
+
+    LInitElem(const LAllocation &object) {
+        setOperand(0, object);
+    }
+
+    static const size_t IdIndex = 1;
+    static const size_t ValueIndex = 1 + BOX_PIECES;
+
+    const LAllocation *getObject() {
+        return getOperand(0);
+    }
+    MInitElem *mir() const {
+        return mir_->toInitElem();
+    }
+};
+
 // Takes in an Object and a Value.
 class LInitProp : public LCallInstructionHelper<0, 1 + BOX_PIECES, 0>
 {

js/src/ion/LOpcodes.h

@@ -32,6 +32,7 @@
     _(ParNewDenseArray)             \
     _(ParNewCallObject)             \
     _(ParBailout)                   \
+    _(InitElem)                     \
     _(InitProp)                     \
     _(CheckOverRecursed)            \
     _(ParCheckOverRecursed)         \

js/src/ion/Lowering.cpp

@@ -237,6 +237,18 @@ LIRGenerator::visitParBailout(MParBailout *ins)
     return add(lir, ins);
 }
 
+bool
+LIRGenerator::visitInitElem(MInitElem *ins)
+{
+    LInitElem *lir = new LInitElem(useRegisterAtStart(ins->getObject()));
+    if (!useBoxAtStart(lir, LInitElem::IdIndex, ins->getId()))
+        return false;
+    if (!useBoxAtStart(lir, LInitElem::ValueIndex, ins->getValue()))
+        return false;
+
+    return add(lir, ins) && assignSafepoint(lir, ins);
+}
+
 bool
 LIRGenerator::visitInitProp(MInitProp *ins)
 {

js/src/ion/Lowering.h

@@ -94,6 +94,7 @@ class LIRGenerator : public LIRGeneratorSpecific
     bool visitParNewCallObject(MParNewCallObject *ins);
     bool visitParNewDenseArray(MParNewDenseArray *ins);
     bool visitParBailout(MParBailout *ins);
+    bool visitInitElem(MInitElem *ins);
     bool visitInitProp(MInitProp *ins);
     bool visitCheckOverRecursed(MCheckOverRecursed *ins);
     bool visitParCheckOverRecursed(MParCheckOverRecursed *ins);

js/src/ion/MIR.h

@@ -1243,6 +1243,39 @@ class MInitProp
     }
 };
 
+class MInitElem
+  : public MAryInstruction<3>,
+    public Mix3Policy<ObjectPolicy<0>, BoxPolicy<1>, BoxPolicy<2> >
+{
+    MInitElem(MDefinition *obj, MDefinition *id, MDefinition *value)
+    {
+        setOperand(0, obj);
+        setOperand(1, id);
+        setOperand(2, value);
+        setResultType(MIRType_None);
+    }
+
+  public:
+    INSTRUCTION_HEADER(InitElem)
+
+    static MInitElem *New(MDefinition *obj, MDefinition *id, MDefinition *value) {
+        return new MInitElem(obj, id, value);
+    }
+
+    MDefinition *getObject() const {
+        return getOperand(0);
+    }
+    MDefinition *getId() const {
+        return getOperand(1);
+    }
+    MDefinition *getValue() const {
+        return getOperand(2);
+    }
+    TypePolicy *typePolicy() {
+        return this;
+    }
+};
+
 // Designates the start of call frame construction.
 // Generates code to adjust the stack pointer for the argument vector.
 // Argc is inferred by checking the use chain during lowering.

js/src/ion/MOpcodes.h

@@ -81,6 +81,7 @@ namespace ion {
     _(NewDeclEnvObject)                                                     \
     _(NewCallObject)                                                        \
     _(NewStringObject)                                                      \
+    _(InitElem)                                                             \
     _(InitProp)                                                             \
     _(Start)                                                                \
     _(OsrEntry)                                                             \

js/src/ion/ParallelArrayAnalysis.cpp

@@ -172,6 +172,7 @@ class ParallelArrayVisitor : public MInstructionVisitor
     CUSTOM_OP(NewObject)
     CUSTOM_OP(NewCallObject)
     CUSTOM_OP(NewParallelArray)
+    UNSAFE_OP(InitElem)
     UNSAFE_OP(InitProp)
     SAFE_OP(Start)
     UNSAFE_OP(OsrEntry)

js/src/ion/TypePolicy.h

@@ -186,6 +186,20 @@ class MixPolicy : public TypePolicy
     }
 };
 
+// Combine three policies.
+template <class Policy1, class Policy2, class Policy3>
+class Mix3Policy : public TypePolicy
+{
+  public:
+    static bool staticAdjustInputs(MInstruction *ins) {
+        return Policy1::staticAdjustInputs(ins) && Policy2::staticAdjustInputs(ins) &&
+               Policy3::staticAdjustInputs(ins);
+    }
+    virtual bool adjustInputs(MInstruction *ins) {
+        return staticAdjustInputs(ins);
+    }
+};
+
 class CallSetElementPolicy : public SingleObjectPolicy
 {
   public: