Bug 1079062 - IonMonkey: Don't fold ternary constructs, when a branch dominates both MPhi predecessors, r=nbp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1079062.js
@@ -0,0 +1,6 @@
+function f(y) {
+ return ((y ? y : 0) ? 0 : y)
+}
+m = [0xf]
+f(m[0])
+assertEq(f(m[0]), 0)
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -1217,18 +1217,40 @@ MPhi::foldsTernary()
return nullptr;
MOZ_ASSERT(block()->numPredecessors() == 2);
MBasicBlock *pred = block()->immediateDominator();
if (!pred || !pred->lastIns()->isTest())
return nullptr;
+ MTest *test = pred->lastIns()->toTest();
+
+ // True branch may only dominate one edge of MPhi.
+ if (test->ifTrue()->dominates(block()->getPredecessor(0)) &&
+ test->ifTrue()->dominates(block()->getPredecessor(1)))
+ {
+ return nullptr;
+ }
+
+ // False branch may only dominate one edge of MPhi.
+ if (test->ifFalse()->dominates(block()->getPredecessor(0)) &&
+ test->ifFalse()->dominates(block()->getPredecessor(1)))
+ {
+ return nullptr;
+ }
+
+ // True and false branch must dominate different edges of MPhi.
+ if (test->ifTrue()->dominates(block()->getPredecessor(0)) ==
+ test->ifFalse()->dominates(block()->getPredecessor(0)))
+ {
+ return nullptr;
+ }
+
// We found a ternary construct.
- MTest *test = pred->lastIns()->toTest();
bool firstIsTrueBranch = test->ifTrue()->dominates(block()->getPredecessor(0));
MDefinition *trueDef = firstIsTrueBranch ? getOperand(0) : getOperand(1);
MDefinition *falseDef = firstIsTrueBranch ? getOperand(1) : getOperand(0);
// Accept either
// testArg ? testArg : constant or
// testArg ? constant : testArg
if (!trueDef->isConstant() && !falseDef->isConstant())