Bug 1013821 - IonMonkey: Implement Not Recover Instruction; r=bbouvier

js/src/jit-test/tests/ion/dce-with-rinstructions.js

@@ -280,6 +280,23 @@ function rmod_object(i) {
     return i;
 }
 
+var uceFault_not_number = eval(uneval(uceFault).replace('uceFault', 'uceFault_not_number'));
+function rnot_number(i) {
+    var x = !i;
+    if (uceFault_not_number(i) || uceFault_not_number(i))
+        assertEq(x, false /* = !99 */);
+    return i;
+}
+
+var uceFault_not_object = eval(uneval(uceFault).replace('uceFault', 'uceFault_not_object'));
+function rnot_object(i) {
+    var o = objectEmulatingUndefined();
+    var x = !o;
+    if(uceFault_not_object(i) || uceFault_not_object(i))
+        assertEq(x, true /* = !undefined = !document.all = !objectEmulatingUndefined() */);
+    return i;
+}
+
 var uceFault_concat_string = eval(uneval(uceFault).replace('uceFault', 'uceFault_concat_string'));
 function rconcat_string(i) {
     var x = "s" + i.toString();
@@ -431,6 +448,8 @@ for (i = 0; i < 100; i++) {
     rdiv_object(i);
     rmod_number(i);
     rmod_object(i);
+    rnot_number(i);
+    rnot_object(i);
     rconcat_string(i);
     rconcat_number(i);
     rstring_length(i);

js/src/jit/MIR.h

@@ -6244,6 +6244,14 @@ class MNot
     bool congruentTo(const MDefinition *ins) const {
         return congruentIfOperandsEqual(ins);
     }
+    bool writeRecoverData(CompactBufferWriter &writer) const;
+    bool canRecoverOnBailout() const {
+        // Non objects are recoverable and objects that cannot emulate
+        // undefined get folded into 'true' by GVN.
+        // So the only way to reach this function with an operand that
+        // is an object is when that object might emulate undefined.
+        return !operandMightEmulateUndefined_;
+    }
 };
 
 // Bailout if index + minimum < 0 or index + maximum >= length. The length used

js/src/jit/Recover.cpp

@@ -484,6 +484,30 @@ RMod::recover(JSContext *cx, SnapshotIterator &iter) const
     return true;
 }
 
+bool
+MNot::writeRecoverData(CompactBufferWriter &writer) const
+{
+    MOZ_ASSERT(canRecoverOnBailout());
+    writer.writeUnsigned(uint32_t(RInstruction::Recover_Not));
+    return true;
+}
+
+RNot::RNot(CompactBufferReader &reader)
+{ }
+
+bool
+RNot::recover(JSContext *cx, SnapshotIterator &iter) const
+{
+    RootedValue v(cx, iter.read());
+    RootedValue result(cx);
+
+    MOZ_ASSERT(!v.isObject());
+    result.setBoolean(!ToBoolean(v));
+
+    iter.storeInstructionResult(result);
+    return true;
+}
+
 bool
 MConcat::writeRecoverData(CompactBufferWriter &writer) const
 {

js/src/jit/Recover.h

@@ -30,6 +30,7 @@ namespace jit {
     _(Mul)                                      \
     _(Div)                                      \
     _(Mod)                                      \
+    _(Not)                                      \
     _(Concat)                                   \
     _(StringLength)                             \
     _(Floor)                                    \
@@ -263,6 +264,18 @@ class RMod MOZ_FINAL : public RInstruction
     bool recover(JSContext *cx, SnapshotIterator &iter) const;
 };
 
+class RNot MOZ_FINAL : public RInstruction
+{
+  public:
+    RINSTRUCTION_HEADER_(Not)
+
+    virtual uint32_t numOperands() const {
+        return 1;
+    }
+
+    bool recover(JSContext *cx, SnapshotIterator &iter) const;
+};
+
 class RConcat MOZ_FINAL : public RInstruction
 {
   public: