Bug 678353: Implement arg increment/decrement, r=dvander
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -377,16 +377,22 @@ IonBuilder::inspectOpcode(JSOp op)
return jsop_binary(op);
case JSOP_LOCALINC:
case JSOP_INCLOCAL:
case JSOP_LOCALDEC:
case JSOP_DECLOCAL:
return jsop_localinc(op);
+ case JSOP_ARGINC:
+ case JSOP_INCARG:
+ case JSOP_ARGDEC:
+ case JSOP_DECARG:
+ return jsop_arginc(op);
+
case JSOP_DOUBLE:
return pushConstant(script->getConst(readIndex(pc)));
case JSOP_STRING:
return pushConstant(StringValue(atoms[GET_INDEX(pc)]));
case JSOP_ZERO:
return pushConstant(Int32Value(0));
@@ -1562,16 +1568,42 @@ IonBuilder::jsop_localinc(JSOp op)
return false;
if (post_incr)
current->pop();
return true;
}
+bool
+IonBuilder::jsop_arginc(JSOp op)
+{
+ int32 amt = (js_CodeSpec[op].format & JOF_INC) ? 1 : -1;
+ bool post_incr = !!(js_CodeSpec[op].format & JOF_POST);
+
+ if (post_incr)
+ current->pushArg(GET_SLOTNO(pc));
+
+ current->pushArg(GET_SLOTNO(pc));
+
+ if (!pushConstant(Int32Value(amt)))
+ return false;
+
+ if (!jsop_binary(JSOP_ADD))
+ return false;
+
+ if (current->setArg(GET_SLOTNO(pc)))
+ return false;
+
+ if (post_incr)
+ current->pop();
+
+ return true;
+}
+
MBasicBlock *
IonBuilder::newBlock(MBasicBlock *predecessor, jsbytecode *pc)
{
MBasicBlock *block = MBasicBlock::New(this, predecessor, pc, MBasicBlock::NORMAL);
graph().addBlock(block);
return block;
}
--- a/js/src/ion/IonBuilder.h
+++ b/js/src/ion/IonBuilder.h
@@ -230,16 +230,17 @@ class IonBuilder : public MIRGenerator
bool snapshotAfter(MInstruction *ins);
bool pushConstant(const Value &v);
bool jsop_bitnot(JSOp op);
bool jsop_bitop(JSOp op);
bool jsop_binary(JSOp op);
bool jsop_ifeq(JSOp op);
bool jsop_localinc(JSOp op);
+ bool jsop_arginc(JSOp op);
private:
JSAtom **atoms;
MBasicBlock *current;
Vector<CFGState, 8, IonAllocPolicy> cfgStack_;
Vector<ControlFlowInfo, 4, IonAllocPolicy> loops_;
Vector<ControlFlowInfo, 0, IonAllocPolicy> switches_;
TypeOracle *oracle;
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug678353.js
@@ -0,0 +1,28 @@
+function f_arginc(a) {
+ var b = a++;
+
+ var c = b+b+b+b+b+b+b+b+b+b;
+ return a + c;
+}
+assertEq(f_arginc(1), 12)
+function f_argdec(a) {
+ var b = a--;
+
+ var c = b+b+b+b+b+b+b+b+b+b;
+ return a + c;
+}
+assertEq(f_argdec(1), 10)
+function f_incarg(a) {
+ var b = ++a;
+
+ var c = b+b+b+b+b+b+b+b+b+b;
+ return a + c;
+}
+assertEq(f_incarg(1), 22)
+function f_decarg(a) {
+ var b = --a;
+
+ var c = b+b+b+b+b+b+b+b+b+b;
+ return a + c;
+}
+assertEq(f_decarg(1), 0)