1518127 - Result type can never be ObjectOrNull in MGuardToClass

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, enhancement, P3)

Description

[André Bargull [:anba]]

The |MIRType::ObjectOrNull| case in [1] can never be true, because |IonBuilder::getInlineReturnType()| never returns |MIRType::ObjectOrNull|.

[1] https://searchfox.org/mozilla-central/rev/f8de61826903996f6bdf41b11a2844dd59ac144f/js/src/jit/MCallOptimize.cpp#2809

Comment 1

[André Bargull [:anba]]

Attachment: bug1518127.patch

The result type for MGuardToClass is always |MIRType::Object|, so remove any other code which handles the case when the result type is not |MIRType::Object|. Also change the assertion in MGuardToClass' constructor to only accept an input which is of type MIRType::Object, which matches the only passed input type to MGuardToClass, cf. <https://searchfox.org/mozilla-central/rev/f8de61826903996f6bdf41b11a2844dd59ac144f/js/src/jit/MCallOptimize.cpp#2805-2807>.

Comment 2

[Ted Campbell [:tcampbell]]

Comment on attachment 9034716 [details] [diff] [review]
bug1518127.patch

Review of attachment 9034716 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks for the explanation!

Comment 3

[André Bargull [:anba]]

Try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=22537cf2fd00e4af6132abd7a05827c37bd79eda

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/96da0c4e18f9
Remove unreachable code in MGuardToClass. r=tcampbell

Comment 5

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/96da0c4e18f9