[INFER] Don't store a integer result in a double slot in JSOP_NEG, bug 643913.
authorBrian Hackett <bhackett1024@gmail.com>
Tue, 22 Mar 2011 16:06:09 -0700
changeset 74839 496bd6239fb88a7d3cdc31874db3e799039aac92
parent 74838 75906fcd8426c8c88aedcf9c6156aa6d7062b6ff
child 74840 13323fd7e400633e813160f830f9fb34a6203fab
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
bugs643913
milestone2.0b13pre
[INFER] Don't store a integer result in a double slot in JSOP_NEG, bug 643913.
js/src/jit-test/tests/jaeger/bug643913.js
js/src/methodjit/FastArithmetic.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/bug643913.js
@@ -0,0 +1,8 @@
+function f() {
+    var x;
+    eval("x = 3.14");
+    x = 123;
+    var y = -(-x);
+    assertEq(y, 123);
+}
+f();
--- a/js/src/methodjit/FastArithmetic.cpp
+++ b/js/src/methodjit/FastArithmetic.cpp
@@ -864,18 +864,23 @@ mjit::Compiler::jsop_neg()
         maybeJumpIfNotInt32(stubcc.masm, jmpNotInt, fe, feTypeReg);
 
         /* Test for 0 and -2147483648 (both result in a double). */
         jmpMinIntOrIntZero = stubcc.masm.branchTest32(Assembler::Zero, reg, Imm32(0x7fffffff));
 
         stubcc.masm.neg32(reg);
 
         /* Sync back with double path. */
-        stubcc.masm.storeValueFromComponents(ImmType(JSVAL_TYPE_INT32), reg,
-                                             frame.addressOf(fe));
+        if (type == JSVAL_TYPE_DOUBLE) {
+            stubcc.masm.convertInt32ToDouble(reg, Registers::FPConversionTemp);
+            stubcc.masm.storeDouble(Registers::FPConversionTemp, frame.addressOf(fe));
+        } else {
+            stubcc.masm.storeValueFromComponents(ImmType(JSVAL_TYPE_INT32), reg,
+                                                 frame.addressOf(fe));
+        }
 
         jmpIntRejoin.setJump(stubcc.masm.jump());
     }
 
     frame.freeReg(reg);
     if (feTypeReg.isSet())
         frame.unpinReg(feTypeReg.reg());