[INFER] Fix regalloc bug in ensureInteger, bug 639478, r=bhackett
authorJan de Mooij <jandemooij@gmail.com>
Tue, 08 Mar 2011 08:07:31 -0800
changeset 74732 c5cd2693106e6445f6ec42f4dc7130a09dd2f6bb
parent 74731 511f51584aad04478fbf1febe7b8fbbc17d7304f
child 74733 c2e81b8264c513ada187154868a4961551a050f8
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
reviewersbhackett
bugs639478
milestone2.0b12pre
[INFER] Fix regalloc bug in ensureInteger, bug 639478, r=bhackett
js/src/jit-test/tests/jaeger/bug639478-1.js
js/src/jit-test/tests/jaeger/bug639478-2.js
js/src/methodjit/FastOps.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/bug639478-1.js
@@ -0,0 +1,5 @@
+
+function f(x) {
+    return (x % 123.45) >> x;
+}
+assertEq(f(-123), -4);
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/bug639478-2.js
@@ -0,0 +1,12 @@
+var y;
+function f() {
+    for(var _ in [3.14]) {
+        y = 3.14;
+        y = y ^ y;
+        return y;
+        
+        function g() {
+        }
+    }
+}
+assertEq(f(), 0);
--- a/js/src/methodjit/FastOps.cpp
+++ b/js/src/methodjit/FastOps.cpp
@@ -132,36 +132,31 @@ mjit::Compiler::ensureInteger(FrameEntry
         RegisterID data = frame.allocReg();
         Jump truncateGuard = masm.branchTruncateDoubleToInt32(fpreg, data);
         stubcc.linkExit(truncateGuard, uses);
 
         frame.learnType(fe, JSVAL_TYPE_INT32, data);
     } else if (!fe->isType(JSVAL_TYPE_INT32)) {
         RegisterID typeReg = frame.tempRegForType(fe);
         frame.pinReg(typeReg);
-        RegisterID dataReg = frame.tempRegForData(fe);
-        frame.pinReg(dataReg);
-        RegisterID scratchReg = frame.allocReg();
-        frame.unpinReg(dataReg);
+        RegisterID dataReg = frame.copyDataIntoReg(fe);
         frame.unpinReg(typeReg);
 
         Jump intGuard = masm.testInt32(Assembler::Equal, typeReg);
         Jump doubleGuard = masm.testDouble(Assembler::NotEqual, typeReg);
         stubcc.linkExit(doubleGuard, uses);
 
         FPRegisterID fpreg = frame.allocFPReg();
         frame.loadDouble(fe, fpreg, masm);
-        Jump truncateGuard = masm.branchTruncateDoubleToInt32(fpreg, scratchReg);
+        Jump truncateGuard = masm.branchTruncateDoubleToInt32(fpreg, dataReg);
         stubcc.linkExit(truncateGuard, uses);
-        masm.move(scratchReg, dataReg);
         intGuard.linkTo(masm.label(), &masm);
 
         frame.freeReg(fpreg);
-        frame.freeReg(scratchReg);
-        frame.learnType(fe, JSVAL_TYPE_INT32);
+        frame.learnType(fe, JSVAL_TYPE_INT32, dataReg);
     }
 }
 
 void
 mjit::Compiler::jsop_rsh()
 {
     FrameEntry *rhs = frame.peek(-1);
     FrameEntry *lhs = frame.peek(-2);