Bug 915301: Prevent MPassArg from receiving a Float32 as an input; r=terrence
authorBenjamin Bouvier <bbouvier@mozilla.com>
Wed, 11 Sep 2013 19:34:40 -0700
changeset 159645 348fe4a17158840dcaf0d5b67c977a872dd7ba19
parent 159644 306bb31682d243064e515eac81f28c9db1f13e98
child 159646 03535a095116bf932c9987faf57f6c6d1538b28d
push id2961
push userlsblakk@mozilla.com
push dateMon, 28 Oct 2013 21:59:28 +0000
treeherdermozilla-beta@73ef4f13486f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersterrence
bugs915301
milestone26.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 915301: Prevent MPassArg from receiving a Float32 as an input; r=terrence
js/src/jit/MIR.h
js/src/jit/TypePolicy.cpp
js/src/jit/TypePolicy.h
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -2589,17 +2589,19 @@ class MReturnFromCtor
     }
 };
 
 // Passes an MDefinition to an MCall. Must occur between an MPrepareCall and
 // MCall. Boxes the input and stores it to the correct location on stack.
 //
 // Arguments are *not* simply pushed onto a call stack: they are evaluated
 // left-to-right, but stored in the arg vector in C-style, right-to-left.
-class MPassArg : public MUnaryInstruction
+class MPassArg
+  : public MUnaryInstruction,
+    public NoFloatPolicy<0>
 {
     int32_t argnum_;
 
   private:
     MPassArg(MDefinition *def)
       : MUnaryInstruction(def), argnum_(-1)
     {
         setResultType(def->type());
@@ -2624,16 +2626,20 @@ class MPassArg : public MUnaryInstructio
     uint32_t getArgnum() const {
         JS_ASSERT(argnum_ >= 0);
         return (uint32_t)argnum_;
     }
     AliasSet getAliasSet() const {
         return AliasSet::None();
     }
     void printOpcode(FILE *fp) const;
+
+    TypePolicy *typePolicy() {
+        return this;
+    }
 };
 
 // Converts a primitive (either typed or untyped) to a double. If the input is
 // not primitive at runtime, a bailout occurs.
 class MToDouble
   : public MUnaryInstruction,
     public ToDoublePolicy
 {
--- a/js/src/jit/TypePolicy.cpp
+++ b/js/src/jit/TypePolicy.cpp
@@ -551,28 +551,16 @@ template bool ObjectPolicy<1>::staticAdj
 template bool ObjectPolicy<2>::staticAdjustInputs(MInstruction *ins);
 template bool ObjectPolicy<3>::staticAdjustInputs(MInstruction *ins);
 
 bool
 CallPolicy::adjustInputs(MInstruction *ins)
 {
     MCall *call = ins->toCall();
 
-    // External calls shouldn't have Float32 parameters
-    for (uint32_t i = 0, numArgs = call->numActualArgs(); i < numArgs; i++) {
-        MDefinition *arg = call->getArg(i+1); // arg 0 is |this|
-        if (arg->type() == MIRType_Float32) {
-            JS_ASSERT(arg->isPassArg()); // can't be a type barrier, as Float32 doesn't rely on type inference
-            MPassArg *passArg = arg->toPassArg();
-            MInstruction *replace = MToDouble::New(passArg->getArgument());
-            passArg->replaceOperand(0, replace);
-            call->block()->insertBefore(passArg, replace);
-        }
-    }
-
     MDefinition *func = call->getFunction();
     if (func->type() == MIRType_Object)
         return true;
 
     // If the function is impossible to call,
     // bail out by causing a subsequent unbox to fail.
     if (func->type() != MIRType_Value)
         func = boxAt(call, func);
--- a/js/src/jit/TypePolicy.h
+++ b/js/src/jit/TypePolicy.h
@@ -170,17 +170,17 @@ class RuntimePolicy : public TypePolicy
         return Float32Policy<Op>::staticAdjustInputs(def);
     }
     void setPolicyType(MIRType type) {
         policyType_ = type;
     }
 };
 
 template <unsigned Op>
-class NoFloatPolicy
+class NoFloatPolicy : public TypePolicy
 {
   public:
     static bool staticAdjustInputs(MInstruction *def);
     bool adjustInputs(MInstruction *def) {
         return staticAdjustInputs(def);
     }
 };