Bug 1316830 - FoldLinearArith: Do not set new additions as truncated by default. r=h4writer
authorNicolas B. Pierron <nicolas.b.pierron@mozilla.com>
Mon, 14 Nov 2016 15:18:07 +0000
changeset 438640 321e451a82b2ec6818cc12aba3edd9379019040e
parent 438639 5b62b77eb236e81ad833cfa57dad77902c51b823
child 438641 732a96ceaf9f42a05419d9df487566d33aa61715
push id35794
push usersledru@mozilla.com
push dateMon, 14 Nov 2016 22:18:09 +0000
reviewersh4writer
bugs1316830
milestone52.0a1
Bug 1316830 - FoldLinearArith: Do not set new additions as truncated by default. r=h4writer
js/src/jit-test/tests/ion/fold-linear-arith-bug1316830.js
js/src/jit/FoldLinearArithConstants.cpp
js/src/jit/MIR.h
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/fold-linear-arith-bug1316830.js
@@ -0,0 +1,9 @@
+function f(x) {
+    return (x | 0) - (-4294967295 | 0) + -2147483647
+}
+x = [1, 4294967295]
+for (var j = 0; j < 2; ++j) {
+    for (var k = 0; k < 3; ++k) {
+        assertEq(f(x[j]), -2147483647 - 2 * j);
+    }
+}
--- a/js/src/jit/FoldLinearArithConstants.cpp
+++ b/js/src/jit/FoldLinearArithConstants.cpp
@@ -62,17 +62,17 @@ AnalyzeAdd(TempAllocator& alloc, MAdd* a
         {
             return;
         }
     }
 
     MInstruction* rhs = MConstant::New(alloc, Int32Value(sum.constant));
     add->block()->insertBefore(add, rhs);
 
-    MAdd* addNew = MAdd::New(alloc, sum.term, rhs, MIRType::Int32);
+    MAdd* addNew = MAdd::New(alloc, sum.term, rhs, MIRType::Int32, add->truncateKind());
 
     add->replaceAllLiveUsesWith(addNew);
     add->block()->insertBefore(add, addNew);
     JitSpew(JitSpew_FLAC, "replaced with: %s%u", addNew->opName(), addNew->id());
     JitSpew(JitSpew_FLAC, "and constant: %s%u (%d)", rhs->opName(), rhs->id(), sum.constant);
 
     // Mark the stale nodes as RecoveredOnBailout since the Sink pass has
     // been run before this pass. DCE will then remove the unused nodes.
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -6796,16 +6796,27 @@ class MAdd : public MBinaryArithInstruct
         specialization_ = type;
         setResultType(type);
         if (type == MIRType::Int32) {
             setTruncateKind(Truncate);
             setCommutative();
         }
     }
 
+    MAdd(MDefinition* left, MDefinition* right, MIRType type, TruncateKind truncateKind)
+      : MAdd(left, right)
+    {
+        specialization_ = type;
+        setResultType(type);
+        if (type == MIRType::Int32) {
+            setTruncateKind(truncateKind);
+            setCommutative();
+        }
+    }
+
   public:
     INSTRUCTION_HEADER(Add)
     TRIVIAL_NEW_WRAPPERS
 
     bool isFloat32Commutative() const override { return true; }
 
     double getIdentity() override {
         return 0;