tor-browser

commit 49b44d2094f6391e8cc2664b40a489d60e9f66a1
parent 88003c5563b582891e2f51def0dbcf16d58117f3
Author: Jan de Mooij <jdemooij@mozilla.com>
Date:   Tue, 25 Nov 2025 07:42:47 +0000

Bug 2001606 - Use useAtStart for fallible MUnbox on x64. r=iain

It used to be that we first checked the type and then did the unbox, so using
`useRegisterAtStart` avoided an extra load, but with `masm.fallibleUnbox*` that no
longer applies.

This doesn't change arm64 because there we'd load the value in a register anyway
for `fallibleUnbox*`.

Drive-by change: remove unused `unboxArgObjMagic` MacroAssembler methods.

Differential Revision: https://phabricator.services.mozilla.com/D273847

Diffstat:
M
js/src/jit/arm64/MacroAssembler-arm64.h
 | 
7
-------
M
js/src/jit/x64/CodeGenerator-x64.cpp
 | 
51
+++++++++++++++++++++++++++++----------------------
M
js/src/jit/x64/Lowering-x64.cpp
 | 
4
----
M
js/src/jit/x64/MacroAssembler-x64.h
 | 
10
----------

4 files changed, 29 insertions(+), 43 deletions(-)
diff --git a/js/src/jit/arm64/MacroAssembler-arm64.h b/js/src/jit/arm64/MacroAssembler-arm64.h
@@ -1333,13 +1333,6 @@ class MacroAssemblerCompat : public vixl::MacroAssembler {
     Fmov(ARMFPRegister(dest, 64), ARMRegister(src.valueReg(), 64));
   }
 
-  void unboxArgObjMagic(const ValueOperand& src, Register dest) {
-    MOZ_CRASH("unboxArgObjMagic");
-  }
-  void unboxArgObjMagic(const Address& src, Register dest) {
-    MOZ_CRASH("unboxArgObjMagic");
-  }
-
   void unboxBoolean(const ValueOperand& src, Register dest) {
     move32(src.valueReg(), dest);
   }
diff --git a/js/src/jit/x64/CodeGenerator-x64.cpp b/js/src/jit/x64/CodeGenerator-x64.cpp
@@ -55,29 +55,36 @@ void CodeGenerator::visitUnbox(LUnbox* unbox) {
   Register result = ToRegister(unbox->output());
 
   if (mir->fallible()) {
-    ValueOperand value = ToValue(unbox->input());
     Label bail;
-    switch (mir->type()) {
-      case MIRType::Int32:
-        masm.fallibleUnboxInt32(value, result, &bail);
-        break;
-      case MIRType::Boolean:
-        masm.fallibleUnboxBoolean(value, result, &bail);
-        break;
-      case MIRType::Object:
-        masm.fallibleUnboxObject(value, result, &bail);
-        break;
-      case MIRType::String:
-        masm.fallibleUnboxString(value, result, &bail);
-        break;
-      case MIRType::Symbol:
-        masm.fallibleUnboxSymbol(value, result, &bail);
-        break;
-      case MIRType::BigInt:
-        masm.fallibleUnboxBigInt(value, result, &bail);
-        break;
-      default:
-        MOZ_CRASH("Given MIRType cannot be unboxed.");
+    auto fallibleUnboxImpl = [&](auto value) {
+      switch (mir->type()) {
+        case MIRType::Int32:
+          masm.fallibleUnboxInt32(value, result, &bail);
+          break;
+        case MIRType::Boolean:
+          masm.fallibleUnboxBoolean(value, result, &bail);
+          break;
+        case MIRType::Object:
+          masm.fallibleUnboxObject(value, result, &bail);
+          break;
+        case MIRType::String:
+          masm.fallibleUnboxString(value, result, &bail);
+          break;
+        case MIRType::Symbol:
+          masm.fallibleUnboxSymbol(value, result, &bail);
+          break;
+        case MIRType::BigInt:
+          masm.fallibleUnboxBigInt(value, result, &bail);
+          break;
+        default:
+          MOZ_CRASH("Given MIRType cannot be unboxed.");
+      }
+    };
+    LAllocation* input = unbox->getOperand(LUnbox::Input);
+    if (input->isGeneralReg()) {
+      fallibleUnboxImpl(ValueOperand(ToRegister(input)));
+    } else {
+      fallibleUnboxImpl(ToAddress(input));
     }
     bailoutFrom(&bail, unbox->snapshot());
     return;
diff --git a/js/src/jit/x64/Lowering-x64.cpp b/js/src/jit/x64/Lowering-x64.cpp
@@ -150,10 +150,6 @@ void LIRGenerator::visitUnbox(MUnbox* unbox) {
   if (IsFloatingPointType(unbox->type())) {
     MOZ_ASSERT(unbox->type() == MIRType::Double);
     lir = new (alloc()) LUnboxFloatingPoint(useBoxAtStart(box));
-  } else if (unbox->fallible()) {
-    // If the unbox is fallible, load the Value in a register first to
-    // avoid multiple loads.
-    lir = new (alloc()) LUnbox(useRegisterAtStart(box));
   } else {
     lir = new (alloc()) LUnbox(useAtStart(box));
   }
diff --git a/js/src/jit/x64/MacroAssembler-x64.h b/js/src/jit/x64/MacroAssembler-x64.h
@@ -780,16 +780,6 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared {
     loadDouble(Operand(src), dest);
   }
 
-  void unboxArgObjMagic(const ValueOperand& src, Register dest) {
-    unboxArgObjMagic(Operand(src.valueReg()), dest);
-  }
-  void unboxArgObjMagic(const Operand& src, Register dest) {
-    mov(ImmWord(0), dest);
-  }
-  void unboxArgObjMagic(const Address& src, Register dest) {
-    unboxArgObjMagic(Operand(src), dest);
-  }
-
   void unboxBoolean(const ValueOperand& src, Register dest) {
     movl(src.valueReg(), dest);
   }