Bug 1526840 - Adapt ToBoolean Ion type inference for false BigInt values r=jandem
authorAndy Wingo <wingo@igalia.com>
Tue, 12 Feb 2019 15:49:54 +0000
changeset 458764 0ca63f8a449c
parent 458763 74f99033251c
child 458765 dcc0c69e319e
push id35548
push useropoprus@mozilla.com
push dateWed, 13 Feb 2019 09:48:26 +0000
treeherdermozilla-central@93e37c529818 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1526840
milestone67.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1526840 - Adapt ToBoolean Ion type inference for false BigInt values r=jandem Differential Revision: https://phabricator.services.mozilla.com/D19477
js/src/jit-test/tests/ion/bug1526840.js
js/src/jit/IonBuilder.cpp
js/src/jit/MIR.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1526840.js
@@ -0,0 +1,12 @@
+
+setJitCompilerOption("offthread-compilation.enable", 0);
+setJitCompilerOption("ion.warmup.trigger", 0);
+
+for (let j = 0; j < 2; ++j) {
+    let z = j ? 0n : 1;
+    if (z) {
+        z = 0;
+    } else {
+        z = 0;
+    }
+}
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -2800,17 +2800,23 @@ AbortReasonOr<Ok> IonBuilder::improveTyp
     filter.addType(TypeSet::BooleanType(), alloc_->lifoAlloc());
   } else if (constant->toString() == TypeName(JSTYPE_NUMBER, names)) {
     filter.addType(TypeSet::Int32Type(), alloc_->lifoAlloc());
     filter.addType(TypeSet::DoubleType(), alloc_->lifoAlloc());
   } else if (constant->toString() == TypeName(JSTYPE_STRING, names)) {
     filter.addType(TypeSet::StringType(), alloc_->lifoAlloc());
   } else if (constant->toString() == TypeName(JSTYPE_SYMBOL, names)) {
     filter.addType(TypeSet::SymbolType(), alloc_->lifoAlloc());
-  } else if (constant->toString() == TypeName(JSTYPE_OBJECT, names)) {
+  }
+#ifdef ENABLE_BIGINT
+  else if (constant->toString() == TypeName(JSTYPE_BIGINT, names)) {
+    filter.addType(TypeSet::BigIntType(), alloc_->lifoAlloc());
+  }
+#endif
+  else if (constant->toString() == TypeName(JSTYPE_OBJECT, names)) {
     filter.addType(TypeSet::NullType(), alloc_->lifoAlloc());
     if (trueBranch) {
       filter.addType(TypeSet::AnyObjectType(), alloc_->lifoAlloc());
     }
   } else if (constant->toString() == TypeName(JSTYPE_FUNCTION, names)) {
     if (typeOf->inputMaybeCallableOrEmulatesUndefined() && trueBranch) {
       filter.addType(TypeSet::AnyObjectType(), alloc_->lifoAlloc());
     }
@@ -3044,16 +3050,20 @@ AbortReasonOr<Ok> IonBuilder::improveTyp
     base.addType(TypeSet::BooleanType(),
                  alloc_->lifoAlloc());  // ToBoolean(false) == false
     base.addType(TypeSet::Int32Type(),
                  alloc_->lifoAlloc());  // ToBoolean(0) == false
     base.addType(TypeSet::DoubleType(),
                  alloc_->lifoAlloc());  // ToBoolean(0.0) == false
     base.addType(TypeSet::StringType(),
                  alloc_->lifoAlloc());  // ToBoolean("") == false
+#ifdef ENABLE_BIGINT
+    base.addType(TypeSet::BigIntType(),
+                 alloc_->lifoAlloc());  // ToBoolean(0n) == false
+#endif
 
     // If the typeset does emulate undefined, then we cannot filter out
     // objects.
     if (oldType->maybeEmulatesUndefined(constraints())) {
       base.addType(TypeSet::AnyObjectType(), alloc_->lifoAlloc());
     }
 
     type = TypeSet::intersectSets(&base, oldType, alloc_->lifoAlloc());
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -6201,17 +6201,21 @@ static bool TryAddTypeBarrierForWrite(Te
   MOZ_ASSERT(aggregateProperty);
 
   MIRType propertyType = aggregateProperty->knownMIRType(constraints);
   switch (propertyType) {
     case MIRType::Boolean:
     case MIRType::Int32:
     case MIRType::Double:
     case MIRType::String:
-    case MIRType::Symbol: {
+    case MIRType::Symbol:
+#ifdef ENABLE_BIGINT
+    case MIRType::BigInt:
+#endif
+    {
       // The property is a particular primitive type, guard by unboxing the
       // value before the write.
       if (!(*pvalue)->mightBeType(propertyType)) {
         // The value's type does not match the property type. Just do a VM
         // call as it will always trigger invalidation of the compiled code.
         MOZ_ASSERT_IF((*pvalue)->type() != MIRType::Value,
                       (*pvalue)->type() != propertyType);
         return false;