tor-browser

commit df4d7643944feb4612d77f6916455d05573dd922
parent 149bb3d3bd6e1f7229760fa153572a3ebb27c76d
Author: André Bargull <andre.bargull@gmail.com>
Date:   Mon, 13 Oct 2025 12:55:25 +0000

Bug 1990248 - Part 4: Remove unnecessary temp register from GuardFuse. r=spidermonkey-reviewers,jandem

The fuse-value is a `size_t`, so comparing against `ImmWord` instead of `ImmPtr`
is okay to do. This allows to use the `branchPtr` overload which directly
compares an `AbsoluteAddress` against an `ImmWord`.

Differential Revision: https://phabricator.services.mozilla.com/D265826

Diffstat:
M
js/src/jit/CodeGenerator.cpp
 | 
5
++---
M
js/src/jit/LIROps.yaml
 | 
4
----
M
js/src/jit/Lowering.cpp
 | 
2
+-
M
js/src/jit/MIROps.yaml
 | 
1
+

4 files changed, 4 insertions(+), 8 deletions(-)
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
@@ -4470,14 +4470,13 @@ void CodeGenerator::visitGuardShape(LGuardShape* guard) {
 void CodeGenerator::visitGuardFuse(LGuardFuse* guard) {
   auto fuseIndex = guard->mir()->fuseIndex();
 
-  Register temp = ToRegister(guard->temp0());
   Label bail;
 
   // Bake specific fuse address for Ion code, because we won't share this code
   // across realms.
   GuardFuse* fuse = mirGen().realm->realmFuses().getFuseByIndex(fuseIndex);
-  masm.loadPtr(AbsoluteAddress(fuse->fuseRef()), temp);
-  masm.branchPtr(Assembler::NotEqual, temp, ImmPtr(nullptr), &bail);
+  masm.branchPtr(Assembler::NotEqual, AbsoluteAddress(fuse->fuseRef()),
+                 ImmWord(0), &bail);
 
   bailoutFrom(&bail, guard->snapshot());
 }
diff --git a/js/src/jit/LIROps.yaml b/js/src/jit/LIROps.yaml
@@ -3029,10 +3029,6 @@
   mir_op: true
   num_temps: 1
 
-- name: GuardFuse
-  mir_op: true
-  num_temps: 1
-
 - name: GuardIsProxy
   operands:
     object: WordSized
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
@@ -5785,7 +5785,7 @@ void LIRGenerator::visitGuardGlobalGeneration(MGuardGlobalGeneration* ins) {
 }
 
 void LIRGenerator::visitGuardFuse(MGuardFuse* ins) {
-  auto* lir = new (alloc()) LGuardFuse(temp());
+  auto* lir = new (alloc()) LGuardFuse();
   assignSnapshot(lir, ins->bailoutKind());
   add(lir, ins);
 }
diff --git a/js/src/jit/MIROps.yaml b/js/src/jit/MIROps.yaml
@@ -2210,6 +2210,7 @@
   movable: true
   congruent_to: custom
   alias_set: custom
+  generate_lir: true
 
 - name: GuardMultipleShapes
   operands: