Revert "Bug 1703469: apply code formatting via Lando" for causing crashes @ js::jit::MGuardFunctionScript::getAliasSet

This reverts commit cd83389.

Revert "Bug 1703469: Add more robust testcase r=jandem"

This reverts commit 7cc7775.

Revert "Bug 1703469: Fix PBL r=jandem"

This reverts commit 0ed90c8.

Revert "Bug 1703469: Inline script-guarded getters and setters r=jandem"

This reverts commit 63b530b.

Revert "Bug 1703469: Use JSScript instead of JSFunction in trial inlining r=jandem"

This reverts commit 33cd9a6.

Revert "Bug 1703469: Remove redundant function arg r=jandem"

This reverts commit aaa3903.

Revert "Bug 1703469: Guard on script instead of function for non-first getter/setters r=jandem"

This reverts commit b1220f6.

Revert "Bug 1703469: Move getter/setter helpers inside IRGenerator r=jandem"

This reverts commit 237d510.

Revert "Bug 1703469: Use operand for callee in scripted setters r=jandem"

This reverts commit f55e9e6.

Revert "Bug 1703469: Use operand for callee in scripted getters r=jandem"

This reverts commit f4f5b7d.

Author: Alexandru Marc

js/src/builtin/TestingFunctions.cpp

@@ -6764,40 +6764,6 @@ static bool ObjectAddress(JSContext* cx, unsigned argc, Value* vp) {
   return ReturnStringCopy(cx, args, buffer);
 }
 
-static bool ScriptAddressForFunction(JSContext* cx, unsigned argc, Value* vp) {
-  CallArgs args = CallArgsFromVp(argc, vp);
-
-  if (js::SupportDifferentialTesting()) {
-    RootedObject callee(cx, &args.callee());
-    ReportUsageErrorASCII(cx, callee,
-                          "Function unavailable in differential testing mode.");
-    return false;
-  }
-
-  if (args.length() != 1) {
-    RootedObject callee(cx, &args.callee());
-    ReportUsageErrorASCII(cx, callee, "Wrong number of arguments");
-    return false;
-  }
-  if (!args[0].isObject() || !args[0].toObject().is<JSFunction>()) {
-    RootedObject callee(cx, &args.callee());
-    ReportUsageErrorASCII(cx, callee, "Expected function");
-    return false;
-  }
-
-  RootedFunction function(cx, &args[0].toObject().as<JSFunction>());
-  if (!function->hasBytecode()) {
-    RootedObject callee(cx, &args.callee());
-    ReportUsageErrorASCII(cx, callee, "Expected non-lazy scripted function");
-    return false;
-  }
-
-  void* ptr = function->nonLazyScript();
-  args.rval().setPrivate(ptr);
-
-  return true;
-}
-
 static bool SharedAddress(JSContext* cx, unsigned argc, Value* vp) {
   CallArgs args = CallArgsFromVp(argc, vp);
 
@@ -10549,10 +10515,6 @@ JS_FOR_WASM_FEATURES(WASM_FEATURE)
 "  Return the current address of the object. For debugging only--this\n"
 "  address may change during a moving GC."),
 
-    JS_FN_HELP("scriptAddressForFunction", ScriptAddressForFunction, 1, 0,
-"scriptAddressForFunction(fun)",
-"  Return the current address of a function's script."),
-
     JS_FN_HELP("sharedAddress", SharedAddress, 1, 0,
 "sharedAddress(obj)",
 "  Return the address of the shared storage of a SharedArrayBuffer."),

js/src/jit-test/tests/cacheir/non-function-getters-2.js

@@ -544,17 +544,19 @@ bool BaselineCacheIRCompiler::emitLoadDynamicSlotResult(ObjOperandId objId,
 }
 
 bool BaselineCacheIRCompiler::emitCallScriptedGetterShared(
-    ValOperandId receiverId, ObjOperandId calleeId, bool sameRealm,
+    ValOperandId receiverId, uint32_t getterOffset, bool sameRealm,
     uint32_t nargsAndFlagsOffset, Maybe<uint32_t> icScriptOffset) {
   ValueOperand receiver = allocator.useValueRegister(masm, receiverId);
-  Register callee = allocator.useRegister(masm, calleeId);
+  Address getterAddr(stubAddress(getterOffset));
 
   AutoScratchRegister code(allocator, masm);
+  AutoScratchRegister callee(allocator, masm);
   AutoScratchRegister scratch(allocator, masm);
 
   bool isInlined = icScriptOffset.isSome();
 
   // First, retrieve raw jitcode for getter.
+  masm.loadPtr(getterAddr, callee);
   if (isInlined) {
     FailurePath* failure;
     if (!addFailurePath(&failure)) {
@@ -619,19 +621,19 @@ bool BaselineCacheIRCompiler::emitCallScriptedGetterShared(
 }
 
 bool BaselineCacheIRCompiler::emitCallScriptedGetterResult(
-    ValOperandId receiverId, ObjOperandId calleeId, bool sameRealm,
+    ValOperandId receiverId, uint32_t getterOffset, bool sameRealm,
     uint32_t nargsAndFlagsOffset) {
   JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
   Maybe<uint32_t> icScriptOffset = mozilla::Nothing();
-  return emitCallScriptedGetterShared(receiverId, calleeId, sameRealm,
+  return emitCallScriptedGetterShared(receiverId, getterOffset, sameRealm,
                                       nargsAndFlagsOffset, icScriptOffset);
 }
 
 bool BaselineCacheIRCompiler::emitCallInlinedGetterResult(
-    ValOperandId receiverId, ObjOperandId calleeId, uint32_t icScriptOffset,
+    ValOperandId receiverId, uint32_t getterOffset, uint32_t icScriptOffset,
     bool sameRealm, uint32_t nargsAndFlagsOffset) {
   JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
-  return emitCallScriptedGetterShared(receiverId, calleeId, sameRealm,
+  return emitCallScriptedGetterShared(receiverId, getterOffset, sameRealm,
                                       nargsAndFlagsOffset,
                                       mozilla::Some(icScriptOffset));
 }
@@ -1649,9 +1651,10 @@ bool BaselineCacheIRCompiler::emitCallNativeSetter(
 }
 
 bool BaselineCacheIRCompiler::emitCallScriptedSetterShared(
-    ObjOperandId receiverId, ObjOperandId calleeId, ValOperandId rhsId,
+    ObjOperandId receiverId, uint32_t setterOffset, ValOperandId rhsId,
     bool sameRealm, uint32_t nargsAndFlagsOffset,
     Maybe<uint32_t> icScriptOffset) {
+  AutoScratchRegister callee(allocator, masm);
   AutoScratchRegister scratch(allocator, masm);
 #if defined(JS_CODEGEN_X86)
   Register code = scratch;
@@ -1660,11 +1663,14 @@ bool BaselineCacheIRCompiler::emitCallScriptedSetterShared(
 #endif
 
   Register receiver = allocator.useRegister(masm, receiverId);
-  Register callee = allocator.useRegister(masm, calleeId);
+  Address setterAddr(stubAddress(setterOffset));
   ValueOperand val = allocator.useValueRegister(masm, rhsId);
 
   bool isInlined = icScriptOffset.isSome();
 
+  // First, load the callee.
+  masm.loadPtr(setterAddr, callee);
+
   if (isInlined) {
     // If we are calling a trial-inlined setter, guard that the
     // target has a BaselineScript.
@@ -1746,20 +1752,21 @@ bool BaselineCacheIRCompiler::emitCallScriptedSetterShared(
 }
 
 bool BaselineCacheIRCompiler::emitCallScriptedSetter(
-    ObjOperandId receiverId, ObjOperandId calleeId, ValOperandId rhsId,
+    ObjOperandId receiverId, uint32_t setterOffset, ValOperandId rhsId,
     bool sameRealm, uint32_t nargsAndFlagsOffset) {
   JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
   Maybe<uint32_t> icScriptOffset = mozilla::Nothing();
-  return emitCallScriptedSetterShared(receiverId, calleeId, rhsId, sameRealm,
-                                      nargsAndFlagsOffset, icScriptOffset);
+  return emitCallScriptedSetterShared(receiverId, setterOffset, rhsId,
+                                      sameRealm, nargsAndFlagsOffset,
+                                      icScriptOffset);
 }
 
 bool BaselineCacheIRCompiler::emitCallInlinedSetter(
-    ObjOperandId receiverId, ObjOperandId calleeId, ValOperandId rhsId,
+    ObjOperandId receiverId, uint32_t setterOffset, ValOperandId rhsId,
     uint32_t icScriptOffset, bool sameRealm, uint32_t nargsAndFlagsOffset) {
   JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
-  return emitCallScriptedSetterShared(receiverId, calleeId, rhsId, sameRealm,
-                                      nargsAndFlagsOffset,
+  return emitCallScriptedSetterShared(receiverId, setterOffset, rhsId,
+                                      sameRealm, nargsAndFlagsOffset,
                                       mozilla::Some(icScriptOffset));
 }
 

js/src/jit-test/tests/cacheir/non-function-getters.js

@@ -118,11 +118,11 @@ class MOZ_RAII BaselineCacheIRCompiler : public CacheIRCompiler {
   void emitAtomizeString(Register str, Register temp, Label* failure);
 
   bool emitCallScriptedGetterShared(ValOperandId receiverId,
-                                    ObjOperandId calleeId, bool sameRealm,
+                                    uint32_t getterOffset, bool sameRealm,
                                     uint32_t nargsAndFlagsOffset,
                                     mozilla::Maybe<uint32_t> icScriptOffset);
   bool emitCallScriptedSetterShared(ObjOperandId receiverId,
-                                    ObjOperandId calleeId, ValOperandId rhsId,
+                                    uint32_t setterOffset, ValOperandId rhsId,
                                     bool sameRealm,
                                     uint32_t nargsAndFlagsOffset,
                                     mozilla::Maybe<uint32_t> icScriptOffset);