Depends on D99870

It was always true at this point.

Depends on D99871

We never used this with Warp.

Depends on D99872

This was used by IonBuilder/BaselineInspector.

Depends on D99992

Depends on D99993

Depends on D99994

collectCoverage and collectCoverageForDebug are equivalent after removing
collectCoverageForPGO. The patch kept collectCoverageForDebug because it had
more callers than collectCoverage.

Also remove the counter increment from the bailout code.

Depends on D99995

Depends on D99996

The Unconditionally type has been unused since bug 1614622, so we can inline
IfUnmarked::ShouldTrace directly and remove the abstraction.

Depends on D99997

Depends on D99998

This function never returned true in practice (tested by adding a MOZ_CRASH and
running jit-tests, Kraken, Octane, SunSpider) so is probably no longer relevant
without the MFilterTypeSet code that was removed earlier.

Depends on D99999

Without TI we can always just return |undefined| for missing properties.

Depends on D100000

https://hg.mozilla.org/mozilla-central/rev/dd7aff8d6f4e
https://hg.mozilla.org/mozilla-central/rev/ecc7dad55fae
https://hg.mozilla.org/mozilla-central/rev/be46b71192f8
https://hg.mozilla.org/mozilla-central/rev/899e65333586

This isn't really relevant for fallback stubs because they're never discarded and
are always in the fallback space, so this lets us remove some confusing code.

Depends on D100105

Depends on D100106

https://hg.mozilla.org/mozilla-central/rev/ace4b47bc69c
https://hg.mozilla.org/mozilla-central/rev/39f87356de52
https://hg.mozilla.org/mozilla-central/rev/1ac0c1a59eaa
https://hg.mozilla.org/mozilla-central/rev/6f370df4c888
https://hg.mozilla.org/mozilla-central/rev/efd4634dbe39
https://hg.mozilla.org/mozilla-central/rev/04986d2d60e7
https://hg.mozilla.org/mozilla-central/rev/0c04df0acbbc
https://hg.mozilla.org/mozilla-central/rev/172464950902
https://hg.mozilla.org/mozilla-central/rev/4c684fa892fd
https://hg.mozilla.org/mozilla-central/rev/ec44a2e66c38

The disabled jit-tests now pass (likely from changes to the inlining heuristics).

Depends on D100676

Depends on D100677

Depends on D100678

• Rename CopyInitializerObject to CopyTemplateObject because it's also used for |new|.
• Change CopyTemplateObject to use the template object's proto instead of changing the group later.
• Change CreateThisWithTemplate to call CopyTemplateObject directly instead of going through NewObjectOperationWithTemplate.

Depends on D100679

Also remove a pointless isSingleton check in DoNewArrayFallback: at this point
only the global object is a singleton.

Depends on D100680

Depends on D100681

There are no any actual uses anymore. Later patches make more changes in this area.

Depends on D100682

Depends on D100683

Depends on D100684

Depends on D100685

This was mainly used to select between JSOp::NewObjectWithGroup and JSOp::NewObject.

Follow-up patches will make more changes in this area.

Depends on D100686

• Rename ObjLiteralFlag::NoValues to ObjLiteralFlag::Singleton and invert it.
• Update comments.

The code in emitObject is massively simpler now and less brittle without TI so
this also deletes the "don't change this" warning there.

Depends on D100687

When disabling/removing the COW-array code we accidentally disabled the
JSOp::Object optimization for array literals in singleton contexts. This patch
restores it.

Depends on D100688

https://hg.mozilla.org/mozilla-central/rev/487ba3fa5f51
https://hg.mozilla.org/mozilla-central/rev/d0bc9d6413c9
https://hg.mozilla.org/mozilla-central/rev/7b3211ee8d8c

This was also used to optimize object-or-null type barriers but now it's only
used for bounds checks.

This reverts a change made for IonBuilder loop restarts (to preserve loop header
phis when restarting a loop).

Then removeBlockIncludingPhis can be removed because removeBlock now always removes
phis too.

Depends on D100790

https://hg.mozilla.org/mozilla-central/rev/538b3438ea17
https://hg.mozilla.org/mozilla-central/rev/cd28fb3ff964
https://hg.mozilla.org/mozilla-central/rev/c38229ecc9a4
https://hg.mozilla.org/mozilla-central/rev/b7097bb2492d
https://hg.mozilla.org/mozilla-central/rev/44024aa16de7
https://hg.mozilla.org/mozilla-central/rev/e4b62ca3e934
https://hg.mozilla.org/mozilla-central/rev/e29abe932823
https://hg.mozilla.org/mozilla-central/rev/d17b081264ff
https://hg.mozilla.org/mozilla-central/rev/3d98e102d0a5
https://hg.mozilla.org/mozilla-central/rev/5553826cc186
https://hg.mozilla.org/mozilla-central/rev/fefd283bfc68
https://hg.mozilla.org/mozilla-central/rev/b465a27e6555
https://hg.mozilla.org/mozilla-central/rev/3e9185713037
https://hg.mozilla.org/mozilla-central/rev/c69c83d5f6ca

Before this patch, the global object was allocated as a singleton object (with its
own group) and after creating the global we changed this group's prototype in
splicePrototype.

With this patch splicePrototype give the object a new group for the new prototype.
This is nicer because it means groups are now almost immutable (there's still a
setProtoUnchecked in mergeRealms that will go away with Stencil).

This will let us remove singleton groups/objects completely in the next patch.
A later patch will clean up and document the code around prototype-splicing more.

Depends on D100906

This also removes ObjectGroup's flags field.

Depends on D100907

Moves splicePrototype from JSObject to GlobalObject.

Depends on D100908

Depends on D100909

Depends on D100910

Also replace the realm-switching code with an assertion and fix one caller.

Depends on D100911

Depends on D100912

Depends on D100913

We now set it in the constructor instead of calling setTypeDescr. Also use
GCPtr<> to simplify the GC tracing code.

Depends on D100914

https://hg.mozilla.org/mozilla-central/rev/1e1bcd8fa525
https://hg.mozilla.org/mozilla-central/rev/0744c8dac041
https://hg.mozilla.org/mozilla-central/rev/c45cd62f221e

Now that we don't have to worry about maintaining property types, we can share more code.
This moves the Baseline version to the base class. Also moves the ArrayPush code
because it uses some of the shared helper functions.

The Ion implementation had some minor differences:

• Typed value register (ported by the next patch).
• For StoreDenseElementHole it ignored the handleAdd flag but now we are consistent with Baseline.
• Ion used AutoSpectreBoundsScratchRegister for x86 but now we pass InvalidReg because the Baseline code does not have enough registers (hopefully fine for Ion IC code given decline of x86).

Depends on D101038

https://hg.mozilla.org/mozilla-central/rev/0cbc0f8e342a
https://hg.mozilla.org/mozilla-central/rev/50e1543242f6
https://hg.mozilla.org/mozilla-central/rev/700e1296e701
https://hg.mozilla.org/mozilla-central/rev/f73a7602dac7
https://hg.mozilla.org/mozilla-central/rev/a5bfda24c627

https://hg.mozilla.org/mozilla-central/rev/74966bf15b00
https://hg.mozilla.org/mozilla-central/rev/1bc78a1cec49
https://hg.mozilla.org/mozilla-central/rev/26a4fb91bce6
https://hg.mozilla.org/mozilla-central/rev/0ee0000c4d78
https://hg.mozilla.org/mozilla-central/rev/e5e6c7c18fa7

https://hg.mozilla.org/mozilla-central/rev/66a11f3b53f8
https://hg.mozilla.org/mozilla-central/rev/6f799a1c3066

These functions use mightBeType for each type, but without TypeSets that always
returns true because the operand has MIRType::Value, so simplify based on that.

There are probably other calls to mightBeType that we can audit/change later as
we notice them, but these ones seemed particularly unnecessary.

Warp doesn't use this and there's a lot of complexity to support recompiling
an IonScript while continuing to use the current one.

It might make sense to add a similar hot tier to Warp at some point, but because
Warp uses trial inlining the implementation would likely be pretty different:
we could invalidate, flag the JitScript as supporting different inlining thresholds,
and go back to Baseline to gather information.

Depends on D101456

https://hg.mozilla.org/mozilla-central/rev/d59ce0d29da5
https://hg.mozilla.org/mozilla-central/rev/83c59ac4bcec