Bug 995673 - IonMonkey: Don't remove MToXXX instructions, when an object flows through, r=jandem
authorHannes Verschore <hv1989@gmail.com>
Tue, 22 Apr 2014 16:46:18 +0200
changeset 198031 6f8bee9b010f6ab2343b40d2bd0e5b77295c30ea
parent 198030 8f28e657fceccffbca18baf558b8eb75af3f2b80
child 198032 545be53282356aa16b87a27c5e19457344a84f13
push id3624
push userasasaki@mozilla.com
push dateMon, 09 Jun 2014 21:49:01 +0000
treeherdermozilla-beta@b1a5da15899a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs995673
milestone31.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 995673 - IonMonkey: Don't remove MToXXX instructions, when an object flows through, r=jandem
js/src/jit-test/tests/ion/bug995673.js
js/src/jit/MIR.h
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug995673.js
@@ -0,0 +1,16 @@
+var total = 0
+
+x = [ [] ]
+x[0].valueOf = function () {
+  total++;
+}
+function f(y) {
+    y != Math.abs()
+}
+(function() {
+    f()
+    f(x[0])
+    f(x[0])
+})()
+
+assertEq(total, 2)
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -2818,16 +2818,20 @@ class MToDouble
   private:
     ConversionKind conversion_;
 
     MToDouble(MDefinition *def, ConversionKind conversion = NonStringPrimitives)
       : MUnaryInstruction(def), conversion_(conversion)
     {
         setResultType(MIRType_Double);
         setMovable();
+
+        // An object might have "valueOf", which means it is effectful.
+        if (def->mightBeType(MIRType_Object))
+            setGuard();
     }
 
   public:
     INSTRUCTION_HEADER(ToDouble)
     static MToDouble *New(TempAllocator &alloc, MDefinition *def,
                           ConversionKind conversion = NonStringPrimitives)
     {
         return new(alloc) MToDouble(def, conversion);
@@ -2880,16 +2884,20 @@ class MToFloat32
   protected:
     ConversionKind conversion_;
 
     MToFloat32(MDefinition *def, ConversionKind conversion)
       : MUnaryInstruction(def), conversion_(conversion)
     {
         setResultType(MIRType_Float32);
         setMovable();
+
+        // An object might have "valueOf", which means it is effectful.
+        if (def->mightBeType(MIRType_Object))
+            setGuard();
     }
 
   public:
     INSTRUCTION_HEADER(ToFloat32)
     static MToFloat32 *New(TempAllocator &alloc, MDefinition *def,
                            ConversionKind conversion = NonStringPrimitives)
     {
         return new(alloc) MToFloat32(def, conversion);
@@ -2988,16 +2996,20 @@ class MToInt32
 
     MToInt32(MDefinition *def, MacroAssembler::IntConversionInputKind conversion)
       : MUnaryInstruction(def),
         canBeNegativeZero_(true),
         conversion_(conversion)
     {
         setResultType(MIRType_Int32);
         setMovable();
+
+        // An object might have "valueOf", which means it is effectful.
+        if (def->mightBeType(MIRType_Object))
+            setGuard();
     }
 
   public:
     INSTRUCTION_HEADER(ToInt32)
     static MToInt32 *New(TempAllocator &alloc, MDefinition *def,
                          MacroAssembler::IntConversionInputKind conversion =
                              MacroAssembler::IntConversion_Any)
     {
@@ -3042,16 +3054,20 @@ class MToInt32
 // operations. This is an infallible ValueToECMAInt32.
 class MTruncateToInt32 : public MUnaryInstruction
 {
     MTruncateToInt32(MDefinition *def)
       : MUnaryInstruction(def)
     {
         setResultType(MIRType_Int32);
         setMovable();
+
+        // An object might have "valueOf", which means it is effectful.
+        if (def->mightBeType(MIRType_Object))
+            setGuard();
     }
 
   public:
     INSTRUCTION_HEADER(TruncateToInt32)
     static MTruncateToInt32 *New(TempAllocator &alloc, MDefinition *def) {
         return new(alloc) MTruncateToInt32(def);
     }
     static MTruncateToInt32 *NewAsmJS(TempAllocator &alloc, MDefinition *def) {