Bug 1362154: Part 6: Fall back to OOL call for named captures in Ion …

…r=jandem

Named captures add a `groups` property to the match result. The shape of that group depends on the regexp. Allocating an object in masm requires monomorphizing on a particular template object, but all of our existing Ion regexp code is designed to handle arbitrary regexps. This means we can't allocate the `groups` object in jitcode without a lot of work.

Given that we have to call into C++ to allocate, we might as well just use the existing OOL fallback. This performs a VM call to RegExpMatcherRaw, which will simply call CreateRegExpMatchResult.

Differential Revision: https://phabricator.services.mozilla.com/D76038

js/src/jit/CodeGenerator.cpp

@@ -2878,6 +2878,18 @@ JitCode* JitRealm::generateRegExpMatcherStub(JSContext* cx) {
     return nullptr;
   }
 
+#ifdef ENABLE_NEW_REGEXP
+  // If a regexp has named captures, fall back to the OOL stub, which
+  // will end up calling CreateRegExpMatchResults.
+  Register shared = temp2;
+  masm.loadPtr(Address(regexp, NativeObject::getFixedSlotOffset(
+                                   RegExpObject::PRIVATE_SLOT)),
+               shared);
+  masm.branchPtr(Assembler::NotEqual,
+                 Address(shared, RegExpShared::offsetOfGroupsTemplate()),
+                 ImmWord(0), &oolEntry);
+#endif
+
   // Construct the result.
   Register object = temp1;
   Label matchResultFallback, matchResultJoin;
@@ -2887,7 +2899,8 @@ JitCode* JitRealm::generateRegExpMatcherStub(JSContext* cx) {
 
 #ifdef ENABLE_NEW_REGEXP
   MOZ_ASSERT(nativeTemplateObj.numFixedSlots() == 0);
-  MOZ_ASSERT(nativeTemplateObj.numDynamicSlots() == 3);
+  // Dynamic slot count is always rounded to a power of 2
+  MOZ_ASSERT(nativeTemplateObj.numDynamicSlots() == 4);
   static_assert(RegExpRealm::MatchResultObjectIndexSlot == 0,
                 "First slot holds the 'index' property");
   static_assert(RegExpRealm::MatchResultObjectInputSlot == 1,
@@ -2903,13 +2916,20 @@ JitCode* JitRealm::generateRegExpMatcherStub(JSContext* cx) {
                 "Second slot holds the 'input' property");
 #endif
 
+  // Initialize the slots of the result object with the dummy values
+  // defined in createMatchResultTemplateObject.
   masm.loadPtr(Address(object, NativeObject::offsetOfSlots()), temp2);
   masm.storeValue(
       nativeTemplateObj.getSlot(RegExpRealm::MatchResultObjectIndexSlot),
       Address(temp2, 0));
   masm.storeValue(
       nativeTemplateObj.getSlot(RegExpRealm::MatchResultObjectInputSlot),
       Address(temp2, sizeof(Value)));
+#ifdef ENABLE_NEW_REGEXP
+  masm.storeValue(
+      nativeTemplateObj.getSlot(RegExpRealm::MatchResultObjectGroupsSlot),
+      Address(temp2, 2 * sizeof(Value)));
+#endif
 
   // clang-format off
    /*

js/src/vm/RegExpShared.h

@@ -290,6 +290,11 @@ class RegExpShared : public gc::TenuredCell {
            (CompilationIndex(latin1) * sizeof(RegExpCompilation)) +
            offsetof(RegExpCompilation, jitCode);
   }
+#ifdef ENABLE_NEW_REGEXP
+  static size_t offsetOfGroupsTemplate() {
+    return offsetof(RegExpShared, groupsTemplate_);
+  }
+#endif
 
   size_t sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf);