[INFER] Don't augment type barriers with undefined value tests at ops which have observed undefined, bug 681004.
authorBrian Hackett <bhackett1024@gmail.com>
Wed, 24 Aug 2011 16:59:54 -0700
changeset 76148 4eed9e7ab27f8a35853328fcd1271efb64dbeb1c
parent 76147 78a56e48dd3c55309866bf656115555705421fb7
child 76149 d60ffe67a13fa6bf622eacf40da9bf7dc5a3f8b5
push id3
push userfelipc@gmail.com
push dateFri, 30 Sep 2011 20:09:13 +0000
bugs681004
milestone9.0a1
[INFER] Don't augment type barriers with undefined value tests at ops which have observed undefined, bug 681004.
js/src/methodjit/Compiler.cpp
js/src/methodjit/FrameState.cpp
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -7302,17 +7302,17 @@ mjit::Compiler::testBarrier(RegisterID t
         return state;
     }
 
     if (testReturn) {
         JS_ASSERT(!testUndefined);
         if (!analysis->getCode(PC).monitoredTypesReturn)
             return state;
     } else if (!hasTypeBarriers(PC)) {
-        if (testUndefined)
+        if (testUndefined && !types->hasType(types::Type::UndefinedType()))
             state.jump.setJump(masm.testUndefined(Assembler::Equal, typeReg));
         return state;
     }
 
 #if 0
     /* Stress test. */
     state.jump.setJump(masm.testInt32(Assembler::NotEqual, typeReg));
     return state;
--- a/js/src/methodjit/FrameState.cpp
+++ b/js/src/methodjit/FrameState.cpp
@@ -792,17 +792,22 @@ FrameState::syncForAllocation(RegisterAl
         if (fe->dataInRegister(reg))
             continue;
 
         if (!freeRegs.hasReg(reg))
             relocateReg(reg, alloc, uses);
 
         if (reg.isReg()) {
             RegisterID nreg = reg.reg();
-            JS_ASSERT(!fe->isType(JSVAL_TYPE_DOUBLE));
+            if (fe->isType(JSVAL_TYPE_DOUBLE)) {
+                JS_ASSERT(!a->analysis->trackSlot(entrySlot(fe)));
+                syncFe(fe);
+                forgetAllRegs(fe);
+                fe->resetSynced();
+            }
             if (fe->data.inMemory()) {
                 masm.loadPayload(addressOf(fe), nreg);
             } else if (fe->isConstant()) {
                 masm.loadValuePayload(fe->getValue(), nreg);
             } else {
                 JS_ASSERT(fe->data.inRegister() && fe->data.reg() != nreg);
                 masm.move(fe->data.reg(), nreg);
                 freeRegs.putReg(fe->data.reg());