Backed out changeset 27da583cfc28 (bug 1871597) for causing mass fail…

…ures on CacheIR.cpp. CLOSED TREE

js/src/jit/CacheIR.cpp

@@ -13539,9 +13539,6 @@ AttachDecision OptimizeGetIteratorIRGenerator::tryAttachArray() {
   Rooted<JSFunction*> iterFun(cx_);
   if (!IsArrayPrototypeOptimizable(cx_, obj.as<ArrayObject>(), &arrProto,
                                    &arrProtoIterSlot, &iterFun)) {
-    // Fuse should be popped.
-    MOZ_ASSERT(
-        !obj->nonCCWRealm()->realmFuses.optimizeGetIteratorFuse.intact());
     return AttachDecision::NoAction;
   }
 
@@ -13552,9 +13549,6 @@ AttachDecision OptimizeGetIteratorIRGenerator::tryAttachArray() {
   Rooted<JSFunction*> nextFun(cx_);
   if (!IsArrayIteratorPrototypeOptimizable(
           cx_, AllowIteratorReturn::No, &arrayIteratorProto, &slot, &nextFun)) {
-    // Fuse should be popped.
-    MOZ_ASSERT(
-        !obj->nonCCWRealm()->realmFuses.optimizeGetIteratorFuse.intact());
     return AttachDecision::NoAction;
   }
 
@@ -13565,20 +13559,10 @@ AttachDecision OptimizeGetIteratorIRGenerator::tryAttachArray() {
   MOZ_ASSERT(obj->is<ArrayObject>());
   writer.guardShape(objId, obj->shape());
   writer.guardArrayIsPacked(objId);
-  bool intact = obj->nonCCWRealm()->realmFuses.optimizeGetIteratorFuse.intact();
 
-  // If the fuse isn't intact but we've still passed all these dynamic checks
-  // then we can attach a version of the IC that dynamically checks to ensure
-  // the required invariants still hold.
-  //
-  // As an example of how this could be the case, consider an assignment
-  //
-  //    Array.prototype[Symbol.iterator] = Array.prototype[Symbol.iterator]
-  //
-  // This assignment pops the fuse, however we can still use the dynamic check
-  // version of this IC, as the actual -value- is still correct.
-  bool useDynamicCheck = !intact || !cx_->options().enableDestructuringFuse();
-  if (useDynamicCheck) {
+  MOZ_ASSERT(obj->nonCCWRealm()->realmFuses.optimizeGetIteratorFuse.intact());
+
+  if (!cx_->options().enableDestructuringFuse()) {
     // Guard on Array.prototype[@@iterator].
     ObjOperandId arrProtoId = writer.loadObject(arrProto);
     ObjOperandId iterId = writer.loadObject(iterFun);
@@ -13604,11 +13588,7 @@ AttachDecision OptimizeGetIteratorIRGenerator::tryAttachArray() {
   writer.loadBooleanResult(true);
   writer.returnFromIC();
 
-  if (useDynamicCheck) {
-    trackAttached("OptimizeGetIterator.Array.Dynamic");
-  } else {
-    trackAttached("OptimizeGetIterator.Array.Fuse");
-  }
+  trackAttached("OptimizeGetIterator.Array");
   return AttachDecision::Attach;
 }