tor-browser

commit af8ce243a20edba08431d3236750dff2abe472a2
parent 027e7a837bf84a8fde14fbbda7e06d90b8bb5c6f
Author: André Bargull <andre.bargull@gmail.com>
Date:   Mon, 20 Oct 2025 12:27:41 +0000

Bug 1991402 - Part 7: Avoid duplicate shape guards for SetSize. r=jandem

Switch `InlinableNativeIRGenerator::tryAttachSetSize()` to use
`emitOptimisticClassGuard` in order to emit a shape guard instead of a class
guard.

MIR instructions after this change:
```
6 GuardShape <object>
7 GuardShape GuardShape6
8 SetObjectSize GuardShape7
```

Then add `MGuardShape::foldsTo` to optimise away the duplicate shape guards.

Drive-by change:
- Simplify `M{GuardShape,CallBindVar}::congruentTo` implementations.

Differential Revision: https://phabricator.services.mozilla.com/D266599

Diffstat:
M
js/src/jit/CacheIR.cpp
 | 
2
+-
M
js/src/jit/MIR.cpp
 | 
18
+++++++-----------
M
js/src/jit/MIROps.yaml
 | 
3
++-

3 files changed, 10 insertions(+), 13 deletions(-)
diff --git a/js/src/jit/CacheIR.cpp b/js/src/jit/CacheIR.cpp
@@ -10901,7 +10901,7 @@ AttachDecision InlinableNativeIRGenerator::tryAttachSetSize() {
   // Guard |this| is a SetObject.
   ValOperandId thisValId = loadThis(calleeId);
   ObjOperandId objId = writer.guardToObject(thisValId);
-  writer.guardClass(objId, GuardClassKind::Set);
+  emitOptimisticClassGuard(objId, &thisval_.toObject(), GuardClassKind::Set);
 
   writer.setSizeResult(objId);
   writer.returnFromIC();
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
@@ -7163,21 +7163,17 @@ MDefinition* MGuardSpecificInt32::foldsTo(TempAllocator& alloc) {
   return this;
 }
 
-bool MCallBindVar::congruentTo(const MDefinition* ins) const {
-  if (!ins->isCallBindVar()) {
-    return false;
+MDefinition* MGuardShape::foldsTo(TempAllocator& alloc) {
+  if (object()->isGuardShape() &&
+      shape() == object()->toGuardShape()->shape()) {
+    return object();
   }
-  return congruentIfOperandsEqual(ins);
+  return this;
 }
 
 bool MGuardShape::congruentTo(const MDefinition* ins) const {
-  if (!ins->isGuardShape()) {
-    return false;
-  }
-  if (shape() != ins->toGuardShape()->shape()) {
-    return false;
-  }
-  return congruentIfOperandsEqual(ins);
+  return congruentIfOperandsEqual(ins) &&
+         shape() == ins->toGuardShape()->shape();
 }
 
 AliasSet MGuardShape::getAliasSet() const {
diff --git a/js/src/jit/MIROps.yaml b/js/src/jit/MIROps.yaml
@@ -2174,7 +2174,7 @@
     environmentChain: Object
   result_type: Object
   movable: true
-  congruent_to: custom
+  congruent_to: if_operands_equal
   alias_set: none
   generate_lir: true
 
@@ -2189,6 +2189,7 @@
   congruent_to: custom
   alias_set: custom
   might_alias: custom
+  folds_to: custom
   generate_lir: true
   lir_temps: 1