This was part of Bug 992845, but as the patch got r+ and the implementation was wrong I stripped the implementation from the previous patch such as it can land without dynamic slot support.

This patch adds support for MSlots, MGuardShape, MLoadSlot, MStoreSlot when we are escaping objects. The test case ensure that we can correctly recover the right values after the bailout, by reading both fixed slots and dynamic slots.

Comment on attachment 8457918 [details] [diff] [review] Scalar Replacement support dynamic slots. Review of attachment 8457918 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/jit/ScalarReplacement.cpp @@ +83,5 @@ > return true; > + > + case MDefinition::Op_Slots: { > +#ifdef DEBUG > + // By construction, MSlots is only used by MStoreSlot and MLoadSlot. // Assert that MSlots are only used by MStoreSlot and MLoadSlot. @@ +87,5 @@ > + // By construction, MSlots is only used by MStoreSlot and MLoadSlot. > + MSlots *ins = def->toSlots(); > + MOZ_ASSERT(ins->object() != 0); > + for (MUseIterator i(ins->usesBegin()); i != ins->usesEnd(); i++) { > + // MSlots are not catured by resume points. // toDefinition should normally never fail, since they don't get captured by resume points.

disabled: https://treeherder.mozilla.org/ui/#/jobs?repo=try&revision=ce7067554b60 enabled: https://treeherder.mozilla.org/ui/#/jobs?repo=try&revision=03b1486470f4 https://hg.mozilla.org/integration/mozilla-inbound/rev/cb3487d8700b