Issue #2308 & #1240 Follow-up - Introduce new increment and decrement operations.

https://bugzilla.mozilla.org/show_bug.cgi?id=1508521

3 files changed, 74 insertions, 4 deletions

diff --git a/js/src/vm/Interpreter-inl.h b/js/src/vm/Interpreter-inl.h
index a48c753f1d..93d2672b0f 100644
--- a/js/src/vm/Interpreter-inl.h
+++ b/js/src/vm/Interpreter-inl.h
@@ -417,6 +417,40 @@ NegOperation(JSContext* cx, HandleScript script, jsbytecode* pc, MutableHandleVa
 }
 
 static MOZ_ALWAYS_INLINE bool
+IncOperation(JSContext* cx,
+            MutableHandleValue val,
+            MutableHandleValue res)
+{
+    MOZ_ASSERT(val.isNumber(), "+1 only callable on result of JSOP_TONUMERIC");
+
+    int32_t i;
+    if (val.isInt32() && (i = val.toInt32()) != INT32_MAX) {
+      res.setInt32(i + 1);
+      return true;
+    }
+
+    res.setNumber(val.toNumber() + 1);
+    return true;
+}
+
+static MOZ_ALWAYS_INLINE bool
+DecOperation(JSContext* cx,
+            MutableHandleValue val,
+            MutableHandleValue res) 
+{
+    MOZ_ASSERT(val.isNumber(), "-1 only callable on result of JSOP_TONUMERIC");
+
+    int32_t i;
+    if (val.isInt32() && (i = val.toInt32()) != INT32_MIN) {
+      res.setInt32(i - 1);
+      return true;
+    }
+
+    res.setNumber(val.toNumber() - 1);
+    return true;
+}
+
+static MOZ_ALWAYS_INLINE bool
 ToIdOperation(JSContext* cx, HandleScript script, jsbytecode* pc, HandleValue idval,
               MutableHandleValue res)
 {
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index a03fa847f7..7b04f5fb72 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -4176,6 +4176,26 @@ CASE(JSOP_IS_CONSTRUCTING)
     PUSH_MAGIC(JS_IS_CONSTRUCTING);
 END_CASE(JSOP_IS_CONSTRUCTING)
 
+CASE(JSOP_INC)
+{
+    ReservedRooted<Value> val(&rootValue0, REGS.sp[-1]);
+    MutableHandleValue res = REGS.stackHandleAt(-1);
+    if (!IncOperation(cx, &val, res)) {
+        goto error;
+    }
+}
+END_CASE(JSOP_INC)
+
+CASE(JSOP_DEC)
+{
+    ReservedRooted<Value> val(&rootValue0, REGS.sp[-1]);
+    MutableHandleValue res = REGS.stackHandleAt(-1);
+    if (!DecOperation(cx, &val, res)) {
+        goto error;
+    }
+}
+END_CASE(JSOP_DEC)
+
 CASE(JSOP_BIGINT)
 {
     PUSH_COPY(script->getConst(GET_UINT32_INDEX(REGS.pc)));
diff --git a/js/src/vm/Opcodes.h b/js/src/vm/Opcodes.h
index ff707aac08..c86a22baac 100644
--- a/js/src/vm/Opcodes.h
+++ b/js/src/vm/Opcodes.h
@@ -2357,7 +2357,25 @@
      *   Operands:
      *   Stack: arg => rval
      */ \
-    macro(JSOP_DYNAMIC_IMPORT, 234, "call-import", NULL,      1,  1,  1,  JOF_BYTE) \
+    macro(JSOP_DYNAMIC_IMPORT, 234, "call-import", NULL, 1,  1,  1,  JOF_BYTE) \
+    /*
+     * Pops the numeric value 'val' from the stack, then pushes 'val + 1'.
+     *
+     *   Category: Operators
+     *   Type: Arithmetic Operators
+     *   Operands:
+     *   Stack: val => (val + 1)
+     */ \
+    macro(JSOP_INC, 235, "inc", NULL, 1, 1, 1, JOF_BYTE) \
+    /*
+     * Pops the numeric value 'val' from the stack, then pushes 'val - 1'.
+     *
+     *   Category: Operators
+     *   Type: Arithmetic Operators
+     *   Operands:
+     *   Stack: val => (val - 1)
+     */ \
+    macro(JSOP_DEC, 236, "dec", NULL, 1, 1, 1, JOF_BYTE) \
     /*
      * Pushes a BigInt constant onto the stack.
      *   Category: Literals
@@ -2365,14 +2383,12 @@
      *   Operands: uint32_t constIndex
      *   Stack: => val
      */ \
-    macro(JSOP_BIGINT, 235, "bigint", NULL,      5, 0, 1, JOF_BIGINT)
+    macro(JSOP_BIGINT, 237, "bigint", NULL,      5, 0, 1, JOF_BIGINT)
 /*
  * In certain circumstances it may be useful to "pad out" the opcode space to
  * a power of two.  Use this macro to do so.
  */
 #define FOR_EACH_TRAILING_UNUSED_OPCODE(macro) \
-    macro(236) \
-    macro(237) \
     macro(238) \
     macro(239) \
     macro(240) \