Backed out changeset 3cbd085908c8 (bug 1314438)
authorIris Hsiao <ihsiao@mozilla.com>
Mon, 07 Nov 2016 17:47:07 +0800
changeset 348081 f9d553507a1657d78b51d6b9b2413d2392d827d0
parent 348080 e5dfb4395051b749c86e11c83d7d2233693c2267
child 348082 7c1c7953fe42420d2a66951b9b1d46171cf0d044
push id10298
push userraliiev@mozilla.com
push dateMon, 14 Nov 2016 12:33:03 +0000
treeherdermozilla-aurora@7e29173b1641 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1314438
milestone52.0a1
backs out3cbd085908c8f930656a42a91f64eafb9d37579b
Backed out changeset 3cbd085908c8 (bug 1314438) CLOSED TREE
js/src/jit-test/tests/ion/bug1314438.js
js/src/jit/MIR.cpp
js/src/jit/ValueNumbering.cpp
deleted file mode 100644
--- a/js/src/jit-test/tests/ion/bug1314438.js
+++ /dev/null
@@ -1,12 +0,0 @@
-
-function f(x) {
-    return Math.pow(x, x) && 0;
-}
-f(0);
-assertEq(uneval(f(-999)), "-0");
-
-function g(x) {
-    return (-1 % x && Math.cos(8) >>> 0);
-}
-g(2);
-assertEq(uneval(g(-1)), "-0");
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -2385,18 +2385,16 @@ MPhi::foldsTernary(TempAllocator& alloc)
     {
         return nullptr;
     }
 
     // If testArg is an int32 type we can:
     // - fold testArg ? testArg : 0 to testArg
     // - fold testArg ? 0 : testArg to 0
     if (testArg->type() == MIRType::Int32 && c->numberToDouble() == 0) {
-        testArg->setGuardRangeBailoutsUnchecked();
-
         // When folding to the constant we need to hoist it.
         if (trueDef == c && !c->block()->dominates(block()))
             c->block()->moveBefore(pred->lastIns(), c);
         return trueDef;
     }
 
     // If testArg is an double type we can:
     // - fold testArg ? testArg : 0.0 to MNaNToZero(testArg)
@@ -2919,19 +2917,16 @@ CanProduceNegativeZero(MDefinition* def)
         default:
             return true;
     }
 }
 
 static inline bool
 NeedNegativeZeroCheck(MDefinition* def)
 {
-    if (def->isGuardRangeBailouts())
-        return true;
-
     // Test if all uses have the same semantics for -0 and 0
     for (MUseIterator use = def->usesBegin(); use != def->usesEnd(); use++) {
         if (use->consumer()->isResumePoint())
             continue;
 
         MDefinition* use_def = use->consumer()->toDefinition();
         switch (use_def->op()) {
           case MDefinition::Op_Add: {
@@ -4388,17 +4383,18 @@ MCompare::tryFoldEqualOperands(bool* res
                compareType_ == Compare_String || compareType_ == Compare_StrictString ||
                compareType_ == Compare_Object || compareType_ == Compare_Bitwise);
 
     if (isDoubleComparison() || isFloat32Comparison()) {
         if (!operandsAreNeverNaN())
             return false;
     }
 
-    lhs()->setGuardRangeBailoutsUnchecked();
+    if (DeadIfUnused(lhs()))
+        lhs()->setGuardRangeBailouts();
 
     *result = (jsop() == JSOP_STRICTEQ);
     return true;
 }
 
 bool
 MCompare::tryFoldTypeOf(bool* result)
 {
--- a/js/src/jit/ValueNumbering.cpp
+++ b/js/src/jit/ValueNumbering.cpp
@@ -791,19 +791,16 @@ ValueNumberer::visitDefinition(MDefiniti
         MOZ_ASSERT(!sim->isDiscarded());
         ReplaceAllUsesWith(def, sim);
 
         // The node's foldsTo said |def| can be replaced by |rep|. If |def| is a
         // guard, then either |rep| is also a guard, or a guard isn't actually
         // needed, so we can clear |def|'s guard flag and let it be discarded.
         def->setNotGuardUnchecked();
 
-        if (def->isGuardRangeBailouts())
-            sim->setGuardRangeBailoutsUnchecked();
-
         if (DeadIfUnused(def)) {
             if (!discardDefsRecursively(def))
                 return false;
 
             // If that ended up discarding |sim|, then we're done here.
             if (sim->isDiscarded())
                 return true;
         }