Bug 819797: Don't use range information when range analysis is disabled, r=bhackett
authorHannes Verschore <hv1989@gmail.com>
Tue, 11 Dec 2012 12:22:03 +0100
changeset 115632 a4a0aa79803867bc2457ffe27ae0ef8f3024655d
parent 115631 32a37874bfd96585d81bee87a67dd745000ee593
child 115633 1181c5df586637733d0bb6781f9f2ed5ef841a95
push idunknown
push userunknown
push dateunknown
reviewersbhackett
bugs819797
milestone20.0a1
Bug 819797: Don't use range information when range analysis is disabled, r=bhackett
js/src/ion/Lowering.cpp
js/src/ion/MIR.cpp
js/src/ion/MIR.h
js/src/jit-test/tests/ion/bug819794.js
--- a/js/src/ion/Lowering.cpp
+++ b/js/src/ion/Lowering.cpp
@@ -734,17 +734,17 @@ LIRGenerator::visitMinMax(MMinMax *ins)
 bool
 LIRGenerator::visitAbs(MAbs *ins)
 {
     MDefinition *num = ins->num();
 
     if (num->type() == MIRType_Int32) {
         LAbsI *lir = new LAbsI(useRegisterAtStart(num));
         // needed to handle abs(INT32_MIN)
-        if (!ins->range()->isFinite() && !assignSnapshot(lir))
+        if (ins->fallible() && !assignSnapshot(lir))
             return false;
         return defineReuseInput(lir, ins, 0);
     }
 
     JS_ASSERT(num->type() == MIRType_Double);
     LAbsD *lir = new LAbsD(useRegisterAtStart(num));
     return defineReuseInput(lir, ins, 0);
 }
--- a/js/src/ion/MIR.cpp
+++ b/js/src/ion/MIR.cpp
@@ -713,16 +713,22 @@ MBinaryArithInstruction::foldsTo(bool us
         return this;
 
     if (IsConstant(lhs, getIdentity()))
         return rhs; // x op id => x
 
     return this;
 }
 
+bool
+MAbs::fallible() const
+{
+    return !range() || !range()->isFinite();
+}
+
 MDefinition *
 MDiv::foldsTo(bool useValueNumbers)
 {
     if (specialization_ == MIRType_None)
         return this;
 
     if (MDefinition *folded = EvaluateConstantOperands(this))
         return folded;
--- a/js/src/ion/MIR.h
+++ b/js/src/ion/MIR.h
@@ -2270,16 +2270,17 @@ class MAbs
         return getOperand(0);
     }
     TypePolicy *typePolicy() {
         return this;
     }
     bool congruentTo(MDefinition *const &ins) const {
         return congruentIfOperandsEqual(ins);
     }
+    bool fallible() const;
 
     AliasSet getAliasSet() const {
         return AliasSet::None();
     }
     void computeRange();
 };
 
 // Inline implementation of Math.sqrt().
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug819794.js
@@ -0,0 +1,7 @@
+x = [];
+x[2] = 1;
+x.unshift(0);
+x.unshift(0);
+x.sort(function() {
+        return Math.abs(4)
+})