Bug 839315: IonMonkey: Fix fault in TypePolicy of MCompare for CompareType_Boolean and CompareType_String, r=jandem
authorHannes Verschore <hv1989@gmail.com>
Mon, 18 Feb 2013 18:32:10 +0100
changeset 122248 95e67683fe4e17e4b8c2321251fe6e7b0c28956d
parent 122247 33feebc4a09f1b3482ad1b7e76933b657d126093
child 122249 cf0437ccd0136992937c757773c157da1ff11169
push id24327
push usergszorc@mozilla.com
push dateTue, 19 Feb 2013 05:22:32 +0000
treeherdermozilla-central@e8f8a3f6f1f6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs839315
milestone21.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 839315: IonMonkey: Fix fault in TypePolicy of MCompare for CompareType_Boolean and CompareType_String, r=jandem
js/src/ion/TypePolicy.cpp
js/src/jit-test/tests/ion/bug839315.js
--- a/js/src/ion/TypePolicy.cpp
+++ b/js/src/ion/TypePolicy.cpp
@@ -116,17 +116,19 @@ ComparePolicy::adjustInputs(MInstruction
        compare->setCompareType(MCompare::Compare_Int32);
     }
 
     // Compare_Boolean specialization is done for "Anything === Bool"
     // As of previous line Anything can't be Boolean
     if (compare->compareType() == MCompare::Compare_Boolean) {
         // Unbox rhs that is definitely Boolean
         MDefinition *rhs = def->getOperand(1);
-        if (rhs->type() == MIRType_Value) {
+        if (rhs->type() != MIRType_Boolean) {
+            if (rhs->type() != MIRType_Value)
+                rhs = boxAt(def, rhs);
             MInstruction *unbox = MUnbox::New(rhs, MIRType_Boolean, MUnbox::Infallible);
             def->block()->insertBefore(def, unbox);
             def->replaceOperand(1, unbox);
         }
 
         JS_ASSERT(def->getOperand(0)->type() != MIRType_Boolean);
         JS_ASSERT(def->getOperand(1)->type() == MIRType_Boolean);
         return true;
@@ -140,17 +142,19 @@ ComparePolicy::adjustInputs(MInstruction
        compare->setCompareType(MCompare::Compare_String);
     }
 
     // Compare_StrictString specialization is done for "Anything === String"
     // As of previous line Anything can't be String
     if (compare->compareType() == MCompare::Compare_StrictString) {
         // Unbox rhs that is definitely String
         MDefinition *rhs = def->getOperand(1);
-        if (rhs->type() == MIRType_Value) {
+        if (rhs->type() != MIRType_String) {
+            if (rhs->type() != MIRType_Value)
+                rhs = boxAt(def, rhs);
             MInstruction *unbox = MUnbox::New(rhs, MIRType_String, MUnbox::Infallible);
             def->block()->insertBefore(def, unbox);
             def->replaceOperand(1, unbox);
         }
 
         JS_ASSERT(def->getOperand(0)->type() != MIRType_String);
         JS_ASSERT(def->getOperand(1)->type() == MIRType_String);
         return true;
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug839315.js
@@ -0,0 +1,18 @@
+function f(x) {
+    switch(x) {
+      case 0:
+      case 100:
+    }
+}
+f("");
+evaluate('f({})', { noScriptRval : true });
+
+function g(x) {
+    switch(x) {
+      case 0.1:
+      case 100:
+    }
+}
+
+g(false);
+evaluate('g({})', { noScriptRval : true });