commit 5f1b3180ba66aec48a76b4ab9241cad67afd31fa
parent 9c8c4d71524e160245b5cb504f47367b55c4a659
Author: Jan de Mooij <jdemooij@mozilla.com>
Date: Fri, 12 Dec 2025 10:35:53 +0000
Bug 2005479 part 3 - Add support for lir_result_type and use it to generate more LIR instructions. r=iain
This adds support for `lir_result_type: none` in MIROps.yaml to allow
MIR instructions with a `result_type` to generate LIR with no outputs.
Differential Revision: https://phabricator.services.mozilla.com/D275981
Diffstat:
3 files changed, 105 insertions(+), 162 deletions(-)
diff --git a/js/src/jit/GenerateLIRFiles.py b/js/src/jit/GenerateLIRFiles.py
@@ -478,12 +478,22 @@ def generate_lir_header(c_out, yaml_path, mir_yaml_path):
assert isinstance(generate_lir, bool)
if generate_lir:
+ # If the instruction has a `lir_result_type`, use it. If not, derive
+ # the LIR result type from the MIR `result_type`.
+ lir_result_type = op.get("lir_result_type", None)
+ assert isinstance(lir_result_type, (type(None), str))
+
result_type = op.get("result_type", None)
assert isinstance(result_type, (type(None), str))
- if result_type:
- result_type = mir_type_to_lir_type(result_type)
- assert result_type in result_types
+ if lir_result_type is not None:
+ if lir_result_type == "none":
+ lir_result_type = None
+ else:
+ assert lir_result_type in result_types
+ elif result_type:
+ lir_result_type = mir_type_to_lir_type(result_type)
+ assert lir_result_type in result_types
successors = None
@@ -512,7 +522,7 @@ def generate_lir_header(c_out, yaml_path, mir_yaml_path):
lir_op_classes.append(
gen_lir_class(
name,
- result_type,
+ lir_result_type,
successors,
operands,
arguments,
diff --git a/js/src/jit/LIROps.yaml b/js/src/jit/LIROps.yaml
@@ -464,23 +464,6 @@
- name: GetInlinedArgumentHole
gen_boilerplate: false
-# Guard that the given flags are not set on the arguments object.
-- name: GuardArgumentsObjectFlags
- operands:
- argsObject: WordSized
- num_temps: 1
- mir_op: true
-
-- name: GuardObjectHasSameRealm
- operands:
- object: WordSized
- num_temps: 1
- mir_op: true
-
-- name: GuardBoundFunctionIsConstructor
- operands:
- object: WordSized
-
- name: BoxNonStrictThis
result_type: WordSized
operands:
@@ -2035,23 +2018,6 @@
synchronization: js::jit::Synchronization
num_temps: 1
-# Guard a resizable array buffer view is in-bounds.
-- name: GuardResizableArrayBufferViewInBounds
- operands:
- object: WordSized
- num_temps: 1
-
-# Guard a resizable array buffer view is in-bounds.
-- name: GuardResizableArrayBufferViewInBoundsOrDetached
- operands:
- object: WordSized
- num_temps: 1
-
-- name: GuardHasAttachedArrayBuffer
- operands:
- object: WordSized
- num_temps: 1
-
# Double to IntPtr, eligible for accessing into a TypedArray or DataView. If
# the index isn't exactly representable as an IntPtr, depending on the
# supportOOB flag on the MIR instruction, either bail out or produce an IntPtr
@@ -2983,22 +2949,11 @@
input: WordSized
expected: WordSized
-- name: GuardSpecificAtom
- operands:
- str: WordSized
- num_temps: 1
- mir_op: true
-
- name: GuardSpecificSymbol
operands:
symbol: WordSized
mir_op: true
-- name: GuardSpecificInt32
- operands:
- num: WordSized
- mir_op: true
-
- name: GuardProto
operands:
object: WordSized
@@ -3010,26 +2965,6 @@
object: WordSized
num_temps: 1
-- name: GuardIsNativeObject
- operands:
- object: WordSized
- num_temps: 1
-
-- name: GuardIsProxy
- operands:
- object: WordSized
- num_temps: 1
-
-- name: GuardIsNotProxy
- operands:
- object: WordSized
- num_temps: 1
-
-- name: GuardIsNotDOMProxy
- operands:
- proxy: WordSized
- num_temps: 1
-
- name: ProxyHasProp
result_type: BoxedValue
operands:
@@ -3038,31 +2973,6 @@
call_instruction: true
mir_op: true
-- name: GuardIsNotArrayBufferMaybeShared
- operands:
- object: WordSized
- num_temps: 1
-
-- name: GuardIsTypedArray
- operands:
- object: WordSized
- num_temps: 1
-
-- name: GuardIsNonResizableTypedArray
- operands:
- object: WordSized
- num_temps: 1
-
-- name: GuardIsResizableTypedArray
- operands:
- object: WordSized
- num_temps: 1
-
-- name: GuardHasProxyHandler
- operands:
- object: WordSized
- mir_op: true
-
- name: GuardNoDenseElements
operands:
input: WordSized
@@ -3664,22 +3574,6 @@
function: WordSized
mir_op: true
-- name: GuardFunctionIsNonBuiltinCtor
- operands:
- function: WordSized
- num_temps: 1
-
-- name: GuardFunctionKind
- operands:
- function: WordSized
- num_temps: 1
- mir_op: true
-
-- name: GuardFunctionScript
- operands:
- function: WordSized
- mir_op: true
-
- name: LexicalCheck
operands:
input: BoxedValue
@@ -3701,19 +3595,10 @@
operands:
value: BoxedValue
-- name: CheckClassHeritage
- operands:
- heritage: BoxedValue
- num_temps: 2
-
- name: CheckThis
operands:
value: BoxedValue
-- name: CheckThisReinit
- operands:
- thisValue: BoxedValue
-
- name: Generator
result_type: WordSized
operands:
@@ -3736,12 +3621,6 @@
value: BoxedValue
call_instruction: true
-- name: GuardArrayIsPacked
- operands:
- array: WordSized
- num_temps: 2
- mir_op: true
-
- name: ObjectStaticProto
result_type: WordSized
operands:
@@ -3752,43 +3631,6 @@
lhs: WordSized
rhs: WordSized
-- name: GuardHasGetterSetter
- operands:
- object: WordSized
- num_temps: 3
- call_instruction: true
- mir_op: true
-
-- name: GuardIsExtensible
- operands:
- object: WordSized
- num_temps: 1
-
-- name: GuardInt32IsNonNegative
- operands:
- index: WordSized
-
-- name: GuardInt32Range
- operands:
- input: WordSized
- mir_op: true
-
-- name: GuardIndexIsNotDenseElement
- operands:
- object: WordSized
- index: WordSized
- num_temps: 2
-
-- name: GuardIndexIsValidUpdateOrAdd
- operands:
- object: WordSized
- index: WordSized
- num_temps: 2
-
-- name: GuardNonGCThing
- operands:
- input: BoxedValue
-
# Canonicalize a double value.
- name: CanonicalizeNaND
result_type: WordSized
diff --git a/js/src/jit/MIROps.yaml b/js/src/jit/MIROps.yaml
@@ -185,6 +185,15 @@
# - attribute not specified (default): number of temps is set to 0
# - number: sets number of temps max 15
#
+# lir_result_type
+# ===============
+# Specifies the result_type of the corresponding LIR op in case generate_lir is
+# true.
+# Possible values:
+# - attribute not specified (default): the LIR result type is based on the MIR
+# op's result_type
+# - none: the LIR instruction does not produce a result
+# - result type: the LIR op's result type
# TODO(no-TI): try to remove this instruction.
- name: Start
@@ -403,6 +412,8 @@
congruent_to: if_operands_equal
# The is-constructor flag is immutable for a bound function.
alias_set: none
+ generate_lir: true
+ lir_result_type: none
# Setting __proto__ in an object literal.
- name: MutateProto
@@ -663,6 +674,9 @@
congruent_to: custom
# The flags are packed with the length in a fixed private slot.
alias_set: custom
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 1
# Guard cx->realm() == obj->realm().
- name: GuardObjectHasSameRealm
@@ -675,6 +689,9 @@
# The object's realm is immutable. The context's realm must always be the same
# realm for this compilation.
alias_set: none
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 1
- name: LoadScriptedProxyHandler
operands:
@@ -1870,6 +1887,9 @@
movable: true
congruent_to: if_operands_equal
alias_set: custom
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 1
# Guard a resizable typed array is in-bounds.
- name: GuardResizableArrayBufferViewInBounds
@@ -1880,6 +1900,9 @@
movable: true
congruent_to: if_operands_equal
alias_set: custom
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 1
# Guard a resizable typed array is in-bounds or detached.
- name: GuardResizableArrayBufferViewInBoundsOrDetached
@@ -1890,6 +1913,9 @@
movable: true
congruent_to: if_operands_equal
alias_set: custom
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 1
# Inline TypedArray.prototype.fill
- name: TypedArrayFill
@@ -2265,6 +2291,9 @@
movable: true
congruent_to: if_operands_equal
alias_set: none
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 1
- name: GuardGlobalGeneration
arguments:
@@ -2286,6 +2315,9 @@
movable: true
congruent_to: if_operands_equal
alias_set: none
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 1
- name: GuardIsNotDOMProxy
operands:
@@ -2295,6 +2327,9 @@
movable: true
congruent_to: if_operands_equal
alias_set: none
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 1
- name: GuardIsNotProxy
operands:
@@ -2305,6 +2340,9 @@
congruent_to: if_operands_equal
folds_to: custom
alias_set: none
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 1
- name: ProxyGet
operands:
@@ -2491,6 +2529,9 @@
congruent_to: if_operands_equal
folds_to: custom
alias_set: none
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 1
- name: GuardIsTypedArray
operands:
@@ -2500,6 +2541,9 @@
movable: true
congruent_to: if_operands_equal
alias_set: none
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 1
- name: GuardIsNonResizableTypedArray
operands:
@@ -2509,6 +2553,9 @@
movable: true
congruent_to: if_operands_equal
alias_set: none
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 1
- name: GuardIsResizableTypedArray
operands:
@@ -2518,6 +2565,9 @@
movable: true
congruent_to: if_operands_equal
alias_set: none
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 1
- name: GuardHasProxyHandler
operands:
@@ -2529,6 +2579,8 @@
movable: true
congruent_to: if_operands_equal
alias_set: none
+ generate_lir: true
+ lir_result_type: none
# Loads a specific JSObject* that was originally nursery-allocated.
# See also WarpObjectField.
@@ -2577,6 +2629,9 @@
movable: true
congruent_to: if_operands_equal
alias_set: custom
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 1
- name: GuardFunctionKind
operands:
@@ -2589,6 +2644,9 @@
movable: true
congruent_to: custom
alias_set: custom
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 1
- name: GuardFunctionScript
operands:
@@ -2606,6 +2664,8 @@
# self-hosted functions is an exception to this, but we don't use this
# guard for self-hosted functions.
alias_set: custom
+ generate_lir: true
+ lir_result_type: none
- name: GuardObjectIdentity
gen_boilerplate: false
@@ -2624,6 +2684,9 @@
congruent_to: custom
folds_to: custom
alias_set: none
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 1
- name: GuardSpecificSymbol
gen_boilerplate: false
@@ -2638,6 +2701,8 @@
movable: true
folds_to: custom
alias_set: none
+ generate_lir: true
+ lir_result_type: none
- name: GuardStringToIndex
operands:
@@ -3269,6 +3334,8 @@
guard: true
folds_to: custom
alias_set: custom
+ generate_lir: true
+ lir_result_type: none
- name: Generator
gen_boilerplate: false
@@ -3336,6 +3403,9 @@
heritage: Value
result_type: Value
guard: true
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 2
- name: DebugCheckSelfHosted
operands:
@@ -3360,6 +3430,9 @@
movable: true
congruent_to: if_operands_equal
alias_set: custom
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 2
- name: GuardElementsArePacked
operands:
@@ -3495,6 +3568,9 @@
possibly_calls: true
congruent_to: custom
alias_set: custom
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 3
- name: GuardIsExtensible
operands:
@@ -3504,6 +3580,9 @@
movable: true
congruent_to: if_operands_equal
alias_set: custom
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 1
- name: GuardInt32IsNonNegative
operands:
@@ -3514,6 +3593,8 @@
congruent_to: if_operands_equal
folds_to: custom
alias_set: none
+ generate_lir: true
+ lir_result_type: none
- name: GuardIntPtrIsNonNegative
operands:
@@ -3538,6 +3619,8 @@
congruent_to: if_operands_equal
folds_to: custom
alias_set: none
+ generate_lir: true
+ lir_result_type: none
# Guard the input index is either greater than the dense initialized length of
# an object, or a hole element.
@@ -3550,6 +3633,9 @@
movable: true
congruent_to: if_operands_equal
alias_set: custom
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 2
# Guard an array object's length can be updated successfully when adding an
# element at the input index.
@@ -3562,6 +3648,9 @@
movable: true
congruent_to: if_operands_equal
alias_set: custom
+ generate_lir: true
+ lir_result_type: none
+ lir_temps: 2
# Add or update a sparse element of an ArrayObject or PlainObject. It's allowed
# for the sparse element to be already present on the object. It may also be an
@@ -3653,6 +3742,8 @@
congruent_to: if_operands_equal
folds_to: custom
alias_set: none
+ generate_lir: true
+ lir_result_type: none
- name: ToHashableNonGCThing
operands:
