Bug 862100: IonMonkey: AddTypeBarrier shouldn't unbox, when type is already double, r=nbp
authorHannes Verschore <hv1989@gmail.com>
Wed, 17 Apr 2013 11:31:50 +0200
changeset 129048 61e66148946065ce6f706c4b73bdfdefa0c9ef8a
parent 129047 0e7c67a08b56b91d559c9a769a9fb193f0ab749c
child 129049 862431c42e7225640c6d0b3e00c81ef25f1bb574
push id24553
push userryanvm@gmail.com
push dateWed, 17 Apr 2013 16:44:13 +0000
treeherdermozilla-central@3607139bd503 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnbp
bugs862100
milestone23.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 862100: IonMonkey: AddTypeBarrier shouldn't unbox, when type is already double, r=nbp
js/src/ion/IonBuilder.cpp
js/src/jit-test/tests/ion/bug862100.js
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -3083,33 +3083,33 @@ IonBuilder::addTypeBarrier(uint32_t i, C
             if (excluded->type == types::Type::DoubleType() &&
                 calleeObs->hasType(types::Type::Int32Type()))
             {
                 // The double type also implies int32, so this implies that
                 // double should be coerced into int if possible, and other
                 // types should remain.
 
                 JSValueType callerType = callerObs->getKnownTypeTag();
-                if (callerType == JSVAL_TYPE_DOUBLE) {
-                    MInstruction *bailType = MToInt32::New(ins);
-                    current->add(bailType);
-                    ins = bailType;
-                } else {
+                if (callerType != JSVAL_TYPE_DOUBLE && ins->type() != MIRType_Double) {
                     // We expect either an Int or a Value, this variant is not
                     // optimized and favor the int variant by filtering out all
                     // other inputs.
                     JS_ASSERT(callerType == JSVAL_TYPE_UNKNOWN);
+                    JS_ASSERT(ins->type() == MIRType_Value);
                     // Bail if the input is not a number.
                     MInstruction *toDouble = MUnbox::New(ins, MIRType_Double, MUnbox::Fallible);
-                    // Bail if the double does not fit in an int.
-                    MInstruction *toInt = MToInt32::New(ins);
                     current->add(toDouble);
-                    current->add(toInt);
-                    ins = toInt;
+                    ins = toDouble;
                 }
+                JS_ASSERT(ins->type() == MIRType_Double ||
+                          ins->type() == MIRType_Value);
+                // Bail if the double does not fit in an int.
+                MInstruction *toInt = MToInt32::New(ins);
+                current->add(toInt);
+                ins = toInt;
 
                 needsBarrier = false;
                 break;
             }
 
             needsBarrier = true;
         }
         excluded = excluded->next;
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug862100.js
@@ -0,0 +1,14 @@
+
+function TestCase(n, d, e, a) {}
+function reportCompare (expected, actual, description) {
+  new TestCase("", description, expected, actual);
+}
+new TestCase( "", "", 0, Number(new Number()) );
+reportCompare(true, true);
+evaluate("\
+function TestCase(n, d, e, a) {}\
+test_negation(-2147483648, 2147483648);\
+test_negation(2147483647, -2147483647);\
+function test_negation(value, expected)\
+    reportCompare(expected, '', '-(' + value + ') == ' + expected);\
+");