Bug 1405457 - Scalar replacement for call objects. r=nbp

Scalar replacement for call objects, should make arrow-declare six-speed test faster.

js/src/jit/IonBuilder.cpp

@@ -6663,14 +6663,16 @@ IonBuilder::createCallObject(MDefinition* callee, MDefinition* env)
     // Get a template CallObject that we'll use to generate inline object
     // creation.
     CallObject* templateObj = inspector->templateCallObject();
+    MConstant* templateCst = MConstant::NewConstraintlessObject(alloc(), templateObj);
+    current->add(templateCst);
 
     // Allocate the object. Run-once scripts need a singleton type, so always do
     // a VM call in such cases.
     MNewCallObjectBase* callObj;
     if (script()->treatAsRunOnce() || templateObj->isSingleton())
-        callObj = MNewSingletonCallObject::New(alloc(), templateObj);
+        callObj = MNewSingletonCallObject::New(alloc(), templateCst);
     else
-        callObj = MNewCallObject::New(alloc(), templateObj);
+        callObj = MNewCallObject::New(alloc(), templateCst);
     current->add(callObj);
 
     // Initialize the object's reserved slots. No post barrier is needed here,

js/src/jit/MIR.h

@@ -11829,28 +11829,23 @@ class MNewNamedLambdaObject : public MNullaryInstruction
     }
 };
 
-class MNewCallObjectBase : public MNullaryInstruction
+class MNewCallObjectBase : public MUnaryInstruction
+                         , public SingleObjectPolicy::Data
 {
-    CompilerGCPointer<CallObject*> templateObj_;
-
   protected:
-    explicit MNewCallObjectBase(CallObject* templateObj)
-      : MNullaryInstruction(),
-        templateObj_(templateObj)
+    MNewCallObjectBase(Opcode op, MConstant* templateObj)
+      : MUnaryInstruction(op, templateObj)
     {
         setResultType(MIRType::Object);
     }
 
   public:
-    CallObject* templateObject() {
-        return templateObj_;
+    CallObject* templateObject() const {
+        return &getOperand(0)->toConstant()->toObject().as<CallObject>();
     }
     AliasSet getAliasSet() const override {
         return AliasSet::None();
     }
-    bool appendRoots(MRootList& roots) const override {
-        return roots.append(templateObj_);
-    }
 };
 
 class MNewCallObject : public MNewCallObjectBase
@@ -11858,16 +11853,17 @@ class MNewCallObject : public MNewCallObjectBase
   public:
     INSTRUCTION_HEADER(NewCallObject)
 
-    explicit MNewCallObject(CallObject* templateObj)
-      : MNewCallObjectBase(templateObj)
+    TRIVIAL_NEW_WRAPPERS
+
+    explicit MNewCallObject(MConstant* templateObj)
+      : MNewCallObjectBase(classOpcode, templateObj)
     {
-        MOZ_ASSERT(!templateObj->isSingleton());
+        MOZ_ASSERT(!templateObject()->isSingleton());
     }
 
-    static MNewCallObject*
-    New(TempAllocator& alloc, CallObject* templateObj)
-    {
-        return new(alloc) MNewCallObject(templateObj);
+    [[nodiscard]] bool writeRecoverData(CompactBufferWriter& writer) const override;
+    bool canRecoverOnBailout() const override {
+        return true;
     }
 };
 
@@ -11876,15 +11872,11 @@ class MNewSingletonCallObject : public MNewCallObjectBase
   public:
     INSTRUCTION_HEADER(NewSingletonCallObject)
 
-    explicit MNewSingletonCallObject(CallObject* templateObj)
-      : MNewCallObjectBase(templateObj)
-    {}
+    TRIVIAL_NEW_WRAPPERS
 
-    static MNewSingletonCallObject*
-    New(TempAllocator& alloc, CallObject* templateObj)
-    {
-        return new(alloc) MNewSingletonCallObject(templateObj);
-    }
+    explicit MNewSingletonCallObject(MConstant* templateObj)
+      : MNewCallObjectBase(classOpcode, templateObj)
+    {}
 };
 
 class MNewStringObject :

js/src/jit/Recover.cpp

@@ -1449,6 +1449,35 @@ RLambdaArrow::recover(JSContext* cx, SnapshotIterator& iter) const
     return true;
 }
 
+bool
+MNewCallObject::writeRecoverData(CompactBufferWriter& writer) const
+{
+    MOZ_ASSERT(canRecoverOnBailout());
+    writer.writeUnsigned(uint32_t(RInstruction::Recover_NewCallObject));
+    return true;
+}
+
+RNewCallObject::RNewCallObject(CompactBufferReader& reader)
+{
+}
+
+bool
+RNewCallObject::recover(JSContext* cx, SnapshotIterator& iter) const
+{
+    Rooted<CallObject*> templateObj(cx, &iter.read().toObject().as<CallObject>());
+
+    RootedShape shape(cx, templateObj->lastProperty());
+    RootedObjectGroup group(cx, templateObj->group());
+    JSObject* resultObject = NewCallObject(cx, shape, group);
+    if (!resultObject)
+        return false;
+
+    RootedValue result(cx);
+    result.setObject(*resultObject);
+    iter.storeInstructionResult(result);
+    return true;
+}
+
 bool
 MObjectState::writeRecoverData(CompactBufferWriter& writer) const
 {

js/src/jit/Recover.h

@@ -101,6 +101,7 @@ namespace jit {
     _(NewTypedArray)                            \
     _(NewArray)                                 \
     _(NewDerivedTypedObject)                    \
+    _(NewCallObject)                            \
     _(CreateThisWithTemplate)                   \
     _(Lambda)                                   \
     _(LambdaArrow)                              \
@@ -607,6 +608,14 @@ class RLambdaArrow final : public RInstruction
     [[nodiscard]] bool recover(JSContext* cx, SnapshotIterator& iter) const override;
 };
 
+class RNewCallObject final : public RInstruction
+{
+  public:
+    RINSTRUCTION_HEADER_NUM_OP_(NewCallObject, 1)
+
+    [[nodiscard]] bool recover(JSContext* cx, SnapshotIterator& iter) const override;
+};
+
 class RObjectState final : public RInstruction
 {
   private: