Bug 1062612 - IonMonkey: Fix cast insertion for truncation of phi operands. r=nbp, a=lmandel
authorDan Gohman <sunfish@mozilla.com>
Thu, 04 Sep 2014 08:04:34 -0700
changeset 217515 6aa082239a6189708334fc92a3e66cedf03b40d2
parent 217514 22ac2e65664bd14e2ace261df312983edbfe47e7
child 217516 9dce8a7d62fcc76ab9324158359714c3a735a6d6
push id6843
push userryanvm@gmail.com
push dateMon, 15 Sep 2014 19:01:50 +0000
treeherdermozilla-aurora@9dce8a7d62fc [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnbp, lmandel
bugs1062612
milestone34.0a2
Bug 1062612 - IonMonkey: Fix cast insertion for truncation of phi operands. r=nbp, a=lmandel
js/src/jit-test/tests/ion/bug1062612.js
js/src/jit/RangeAnalysis.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1062612.js
@@ -0,0 +1,7 @@
+x = [0, 1, 1, 0, 1, 1];
+y = -1;
+sum = 0;
+for (var j = 0; j < x.length; ++j) {
+    sum = sum + (x[j] ? 0 : (y >>> 0)) | 0;
+}
+assertEq(sum, -2);
--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -2577,17 +2577,17 @@ AdjustTruncatedInputs(TempAllocator &all
         } else {
             MInstruction *op;
             if (kind == MDefinition::TruncateAfterBailouts)
                 op = MToInt32::New(alloc, truncated->getOperand(i));
             else
                 op = MTruncateToInt32::New(alloc, truncated->getOperand(i));
 
             if (truncated->isPhi()) {
-                MBasicBlock *pred = op->block()->getPredecessor(i);
+                MBasicBlock *pred = block->getPredecessor(i);
                 pred->insertBefore(pred->lastIns(), op);
             } else {
                 block->insertBefore(truncated->toInstruction(), op);
             }
             truncated->replaceOperand(i, op);
         }
     }