Bug 1085298 - IonMonkey: Fix for when folding ternary constructs and a branch dominates both MPhi predecessors, r=nbp
authorHannes Verschore <hv1989@gmail.com>
Thu, 23 Oct 2014 15:34:13 +0200
changeset 211943 c12ed538e44addd704196eddec0a2af7d47f8faa
parent 211942 2b05d4e71d1165060e1ebcf9cdcbbf5b85ee812d
child 211944 bc502295d1dda7c53ed06596425b370d57a6d1fa
push id27693
push userryanvm@gmail.com
push dateThu, 23 Oct 2014 18:06:22 +0000
treeherdermozilla-central@d8de0d7e52e0 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnbp
bugs1085298
milestone36.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1085298 - IonMonkey: Fix for when folding ternary constructs and a branch dominates both MPhi predecessors, r=nbp
js/src/jit-test/tests/ion/bug1085298.js
js/src/jit/MIR.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1085298.js
@@ -0,0 +1,7 @@
+function f(x, y) {
+        return (y | 0 && x ? y | 0 : 0)
+}
+m = [1]
+assertEq(f(m[0], m[0]), 1)
+assertEq(f(m[1], m[0]), 0)
+assertEq(f(m[2], m[0]), 0)
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -1260,24 +1260,24 @@ MPhi::foldsTernary()
 
     MBasicBlock *pred = block()->immediateDominator();
     if (!pred || !pred->lastIns()->isTest())
         return nullptr;
 
     MTest *test = pred->lastIns()->toTest();
 
     // True branch may only dominate one edge of MPhi.
-    if (test->ifTrue()->dominates(block()->getPredecessor(0)) &&
+    if (test->ifTrue()->dominates(block()->getPredecessor(0)) ==
         test->ifTrue()->dominates(block()->getPredecessor(1)))
     {
         return nullptr;
     }
 
     // False branch may only dominate one edge of MPhi.
-    if (test->ifFalse()->dominates(block()->getPredecessor(0)) &&
+    if (test->ifFalse()->dominates(block()->getPredecessor(0)) ==
         test->ifFalse()->dominates(block()->getPredecessor(1)))
     {
         return nullptr;
     }
 
     // True and false branch must dominate different edges of MPhi.
     if (test->ifTrue()->dominates(block()->getPredecessor(0)) ==
         test->ifFalse()->dominates(block()->getPredecessor(0)))