Fix isNotType() usage in jsop_rhs_unknown_any(). b=593554, r=dvander.
☠☠ backed out by 51c060e00161 ☠ ☠
authorSean Stangl <sstangl@mozilla.com>
Tue, 07 Sep 2010 21:05:01 -0400
changeset 53600 45f147e08faf61b0ab5aa7db2ad7428da9aaf575
parent 53599 4f0f0d22e3c5c4235642786c850c51b88f22e0f3
child 53601 2bfe3a246736479051816bd9bde7ef89a3013ac3
child 53602 51c060e00161318624f5ac5b3ec4ff23f42ab5a3
push idunknown
push userunknown
push dateunknown
reviewersdvander
bugs593554
milestone2.0b6pre
Fix isNotType() usage in jsop_rhs_unknown_any(). b=593554, r=dvander.
js/src/methodjit/FastOps.cpp
js/src/trace-test/tests/jaeger/bug593554.js
--- a/js/src/methodjit/FastOps.cpp
+++ b/js/src/methodjit/FastOps.cpp
@@ -189,52 +189,52 @@ mjit::Compiler::jsop_rsh_int_unknown(Fra
     frame.pushTypedPayload(JSVAL_TYPE_INT32, lhsData);
 
     stubcc.rejoin(Changes(1));
 }
 
 void
 mjit::Compiler::jsop_rsh_unknown_any(FrameEntry *lhs, FrameEntry *rhs)
 {
-    RegisterID rhsData = rightRegForShift(rhs);
+    JS_ASSERT(!lhs->isTypeKnown() && !rhs->isTypeKnown());
 
-    MaybeRegisterID rhsType;
-    if (rhs->isNotType(JSVAL_TYPE_INT32)) {
-        rhsType.setReg(frame.tempRegForType(rhs));
-        frame.pinReg(rhsType.reg());
-    }
+    /* Allocate registers. */
+    RegisterID rhsData = rightRegForShift(rhs);
+    RegisterID rhsType = frame.tempRegForType(rhs);
+    frame.pinReg(rhsType);
 
     RegisterID lhsType = frame.tempRegForType(lhs);
     frame.pinReg(lhsType);
     RegisterID lhsData = frame.copyDataIntoReg(lhs);
     frame.unpinReg(lhsType);
-    if (rhsType.isSet())
-        frame.unpinReg(rhsType.reg());
 
-    MaybeJump rhsIntGuard;
-    if (rhs->isNotType(JSVAL_TYPE_INT32))
-        rhsIntGuard.setJump(masm.testInt32(Assembler::NotEqual, rhsType.reg()));
+    /* Non-integer rhs jumps to stub. */
+    Jump rhsIntGuard = masm.testInt32(Assembler::NotEqual, rhsType);
+    frame.unpinReg(rhsType);
 
+    /* Non-integer lhs goes to double guard. */
     Jump lhsIntGuard = masm.testInt32(Assembler::NotEqual, lhsType);
     stubcc.linkExitDirect(lhsIntGuard, stubcc.masm.label());
 
+    /* Attempt to convert lhs double to int32. */
     Jump lhsDoubleGuard = stubcc.masm.testDouble(Assembler::NotEqual, lhsType);
     frame.loadDouble(lhs, FPRegisters::First, stubcc.masm);
     Jump lhsTruncateGuard = stubcc.masm.branchTruncateDoubleToInt32(FPRegisters::First, lhsData);
     stubcc.crossJump(stubcc.masm.jump(), masm.label());
 
     lhsDoubleGuard.linkTo(stubcc.masm.label(), &stubcc.masm);
     lhsTruncateGuard.linkTo(stubcc.masm.label(), &stubcc.masm);
 
-    if (rhsIntGuard.isSet())
-        stubcc.linkExitDirect(rhsIntGuard.getJump(), stubcc.masm.label());
+    stubcc.linkExitDirect(rhsIntGuard, stubcc.masm.label());
+
     frame.sync(stubcc.masm, Uses(2));
     stubcc.call(stubs::Rsh);
 
     masm.rshift32(rhsData, lhsData);
+
     frame.freeReg(rhsData);
     frame.popn(2);
     frame.pushTypedPayload(JSVAL_TYPE_INT32, lhsData);
 
     stubcc.rejoin(Changes(1));
 }
 
 void
new file mode 100644
--- /dev/null
+++ b/js/src/trace-test/tests/jaeger/bug593554.js
@@ -0,0 +1,8 @@
+/* Don't assert. */
+var b = 7;
+var a = [];
+for (var j = 0; j < 7; ++j) {
+    var d = {};
+    a.push(b >> d);
+}
+assertEq(a.toString(), "7,7,7,7,7,7,7");