tor-browser

commit 028dec669c7ee39eb14a28ad909b84c9b016f01e
parent 31f83fab5dc7918ea8986ecb3f40c2ac47c2a93c
Author: André Bargull <andre.bargull@gmail.com>
Date:   Tue, 21 Oct 2025 07:05:42 +0000

Bug 1991402 - Part 13: Make MathRandomResult a shared CacheIR instruction. r=jandem

Use `AutoScratchFloatRegister` and `emitLoadStubField` to make this a shared
CacheIR instruction.

Differential Revision: https://phabricator.services.mozilla.com/D266769

Diffstat:
A
js/src/jit-test/tests/cacheir/inlinable-native-accessor-6.js
 | 
11
+++++++++++
M
js/src/jit/BaselineCacheIRCompiler.cpp
 | 
23
-----------------------
M
js/src/jit/CacheIRCompiler.cpp
 | 
22
++++++++++++++++++++++
M
js/src/jit/CacheIROps.yaml
 | 
2
+-
M
js/src/jit/IonCacheIRCompiler.cpp
 | 
4
----

5 files changed, 34 insertions(+), 28 deletions(-)
diff --git a/js/src/jit-test/tests/cacheir/inlinable-native-accessor-6.js b/js/src/jit-test/tests/cacheir/inlinable-native-accessor-6.js
@@ -0,0 +1,11 @@
+setJitCompilerOption("ion.forceinlineCaches", 1);
+
+function testMathRandom() {
+  var obj = Object.defineProperty({}, "random", {get: Math.random});
+
+  for (var i = 0; i < 100; ++i) {
+    var r = obj.random;
+    assertEq(0 <= r && r < 1, true);
+  }
+}
+testMathRandom();
diff --git a/js/src/jit/BaselineCacheIRCompiler.cpp b/js/src/jit/BaselineCacheIRCompiler.cpp
@@ -26,7 +26,6 @@
 #include "js/friend/DOMProxy.h"       // JS::ExpandoAndGeneration
 #include "proxy/DeadObjectProxy.h"
 #include "proxy/Proxy.h"
-#include "util/DifferentialTesting.h"
 #include "util/Unicode.h"
 #include "vm/PortableBaselineInterpret.h"
 #include "vm/StaticStrings.h"
@@ -1454,28 +1453,6 @@ bool BaselineCacheIRCompiler::emitStringFromCodePointResult(
   return emitStringFromCodeResult(codeId, StringCode::CodePoint);
 }
 
-bool BaselineCacheIRCompiler::emitMathRandomResult(uint32_t rngOffset) {
-  JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
-
-  AutoOutputRegister output(*this);
-  AutoScratchRegister scratch1(allocator, masm);
-  AutoScratchRegister64 scratch2(allocator, masm);
-  AutoAvailableFloatRegister scratchFloat(*this, FloatReg0);
-
-  Address rngAddr(stubAddress(rngOffset));
-  masm.loadPtr(rngAddr, scratch1);
-
-  masm.randomDouble(scratch1, scratchFloat, scratch2,
-                    output.valueReg().toRegister64());
-
-  if (js::SupportDifferentialTesting()) {
-    masm.loadConstantDouble(0.0, scratchFloat);
-  }
-
-  masm.boxDouble(scratchFloat, output.valueReg(), scratchFloat);
-  return true;
-}
-
 bool BaselineCacheIRCompiler::emitReflectGetPrototypeOfResult(
     ObjOperandId objId) {
   JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
diff --git a/js/src/jit/CacheIRCompiler.cpp b/js/src/jit/CacheIRCompiler.cpp
@@ -6972,6 +6972,28 @@ bool CacheIRCompiler::emitMathRoundToInt32Result(NumberOperandId inputId) {
   return true;
 }
 
+bool CacheIRCompiler::emitMathRandomResult(uint32_t rngOffset) {
+  JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
+
+  AutoOutputRegister output(*this);
+  AutoScratchRegister scratch1(allocator, masm);
+  AutoScratchRegister64 scratch2(allocator, masm);
+  AutoScratchFloatRegister scratchFloat(this);
+
+  StubFieldOffset offset(rngOffset, StubField::Type::RawPointer);
+  emitLoadStubField(offset, scratch1);
+
+  masm.randomDouble(scratch1, scratchFloat, scratch2,
+                    output.valueReg().toRegister64());
+
+  if (js::SupportDifferentialTesting()) {
+    masm.loadConstantDouble(0.0, scratchFloat);
+  }
+
+  masm.boxDouble(scratchFloat, output.valueReg(), scratchFloat);
+  return true;
+}
+
 bool CacheIRCompiler::emitInt32MinMax(bool isMax, Int32OperandId firstId,
                                       Int32OperandId secondId,
                                       Int32OperandId resultId) {
diff --git a/js/src/jit/CacheIROps.yaml b/js/src/jit/CacheIROps.yaml
@@ -1688,7 +1688,7 @@
 # Because Baseline stub code is shared by all realms in the Zone, this
 # instruction loads a pointer to the RNG from a stub field.
 - name: MathRandomResult
-  shared: false
+  shared: true
   transpile: true
   cost_estimate: 3
   args:
diff --git a/js/src/jit/IonCacheIRCompiler.cpp b/js/src/jit/IonCacheIRCompiler.cpp
@@ -2333,10 +2333,6 @@ bool IonCacheIRCompiler::emitStringFromCodePointResult(Int32OperandId codeId) {
   MOZ_CRASH("Call ICs not used in ion");
 }
 
-bool IonCacheIRCompiler::emitMathRandomResult(uint32_t rngOffset) {
-  MOZ_CRASH("Call ICs not used in ion");
-}
-
 bool IonCacheIRCompiler::emitReflectGetPrototypeOfResult(ObjOperandId objId) {
   MOZ_CRASH("Call ICs not used in ion");
 }