Bug 1000960 - IonMonkey (ARM): Correct the order of the operands in moveFloat32. r=mjrosenb, a=sledru
authorDouglas Crosher <dtc-moz@scieneer.com>
Fri, 02 May 2014 01:18:57 +1000
changeset 192214 10e5a05f34b3
parent 192213 594456499788
child 192215 56d4c53323c0
push id3526
push userryanvm@gmail.com
push date2014-05-07 15:03 +0000
Treeherderresults
reviewersmjrosenb, sledru
bugs1000960
milestone30.0
Bug 1000960 - IonMonkey (ARM): Correct the order of the operands in moveFloat32. r=mjrosenb, a=sledru
js/src/jit-test/tests/ion/bug1000960.js
js/src/jit/arm/MacroAssembler-arm.h
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1000960.js
@@ -0,0 +1,9 @@
+function testFloat32SetElemIC(a) {
+  for (var i = 0; i < a.length; i++) {
+    var r = Math.fround(Number.MAX_VALUE);
+    a[i] = r;
+    assertEq(a[i], r);
+  }
+}
+testFloat32SetElemIC(new Array(2048));
+testFloat32SetElemIC(new Float32Array(2048));
--- a/js/src/jit/arm/MacroAssembler-arm.h
+++ b/js/src/jit/arm/MacroAssembler-arm.h
@@ -1502,17 +1502,17 @@ class MacroAssemblerARMCompat : public M
         ma_mov(c, lr);
         ma_str(lr, dest);
     }
     BufferOffset ma_BoundsCheck(Register bounded) {
         return as_cmp(bounded, Imm8(0));
     }
 
     void moveFloat32(FloatRegister src, FloatRegister dest) {
-        as_vmov(VFPRegister(src).singleOverlay(), VFPRegister(dest).singleOverlay());
+        as_vmov(VFPRegister(dest).singleOverlay(), VFPRegister(src).singleOverlay());
     }
 };
 
 typedef MacroAssemblerARMCompat MacroAssemblerSpecific;
 
 } // namespace jit
 } // namespace js