tor-browser

commit 25879025a5e12d78b64c644e3872bed7d98938d0
parent 7a6dcba50e3fbbe42cd56cc36b60cc9d9672a4dd
Author: André Bargull <andre.bargull@gmail.com>
Date:   Tue, 21 Oct 2025 07:05:43 +0000

Bug 1991402 - Part 15: Support in CallNumberToString Ion ICs. r=jandem

Use `AutoScratchFloatRegister` instead of `AutoAvailableFloatRegister`, because
Ion get-property ICs don't reserve `FloatReg0`.

Differential Revision: https://phabricator.services.mozilla.com/D266771

Diffstat:
M
js/src/jit-test/tests/cacheir/inlinable-native-accessor-6.js
 | 
10
++++++++++
M
js/src/jit/CacheIRCompiler.cpp
 | 
11
++++++-----

2 files changed, 16 insertions(+), 5 deletions(-)
diff --git a/js/src/jit-test/tests/cacheir/inlinable-native-accessor-6.js b/js/src/jit-test/tests/cacheir/inlinable-native-accessor-6.js
@@ -19,3 +19,13 @@ function testDateGetTime() {
   }
 }
 testDateGetTime();
+
+function testNumberToString() {
+  Object.defineProperty(Number.prototype, "tostr", {get: Number.prototype.toString});
+
+  for (var i = 0; i < 100; ++i) {
+    assertEq(0..tostr, "0");
+    assertEq(0.5.tostr, "0.5");
+  }
+}
+testNumberToString();
diff --git a/js/src/jit/CacheIRCompiler.cpp b/js/src/jit/CacheIRCompiler.cpp
@@ -9855,9 +9855,6 @@ bool CacheIRCompiler::emitCallNumberToString(NumberOperandId inputId,
                                              StringOperandId resultId) {
   JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
 
-  AutoAvailableFloatRegister floatScratch0(*this, FloatReg0);
-
-  allocator.ensureDoubleRegister(masm, inputId, floatScratch0);
   Register result = allocator.defineRegister(masm, resultId);
 
   FailurePath* failure;
@@ -9865,6 +9862,9 @@ bool CacheIRCompiler::emitCallNumberToString(NumberOperandId inputId,
     return false;
   }
 
+  AutoScratchFloatRegister scratchFloat(this, failure);
+  allocator.ensureDoubleRegister(masm, inputId, scratchFloat);
+
   LiveRegisterSet volatileRegs = liveVolatileRegs();
   volatileRegs.takeUnchecked(result);
   masm.PushRegsInMask(volatileRegs);
@@ -9873,13 +9873,14 @@ bool CacheIRCompiler::emitCallNumberToString(NumberOperandId inputId,
   masm.setupUnalignedABICall(result);
   masm.loadJSContext(result);
   masm.passABIArg(result);
-  masm.passABIArg(floatScratch0, ABIType::Float64);
+  masm.passABIArg(scratchFloat, ABIType::Float64);
   masm.callWithABI<Fn, js::NumberToStringPure>();
 
   masm.storeCallPointerResult(result);
   masm.PopRegsInMask(volatileRegs);
 
-  masm.branchPtr(Assembler::Equal, result, ImmPtr(nullptr), failure->label());
+  masm.branchPtr(Assembler::Equal, result, ImmPtr(nullptr),
+                 scratchFloat.failure());
   return true;
 }