Bug 1062612 - IonMonkey: Fix cast insertion for truncation of phi operands. r=nbp, a=lmandel
authorDan Gohman <sunfish@mozilla.com>
Thu, 04 Sep 2014 08:04:34 -0700
changeset 216747 c5ee54bc44f8
parent 216746 316374007734
child 216748 b8c9b76b6585
push id3896
push userryanvm@gmail.com
push date2014-09-15 19:15 +0000
treeherdermozilla-beta@c5ee54bc44f8 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnbp, lmandel
bugs1062612
milestone33.0
Bug 1062612 - IonMonkey: Fix cast insertion for truncation of phi operands. r=nbp, a=lmandel
js/src/jit-test/tests/ion/bug1062612.js
js/src/jit/RangeAnalysis.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1062612.js
@@ -0,0 +1,7 @@
+x = [0, 1, 1, 0, 1, 1];
+y = -1;
+sum = 0;
+for (var j = 0; j < x.length; ++j) {
+    sum = sum + (x[j] ? 0 : (y >>> 0)) | 0;
+}
+assertEq(sum, -2);
--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -2613,17 +2613,17 @@ AdjustTruncatedInputs(TempAllocator &all
         } else {
             MInstruction *op;
             if (kind == MDefinition::TruncateAfterBailouts)
                 op = MToInt32::New(alloc, truncated->getOperand(i));
             else
                 op = MTruncateToInt32::New(alloc, truncated->getOperand(i));
 
             if (truncated->isPhi()) {
-                MBasicBlock *pred = op->block()->getPredecessor(i);
+                MBasicBlock *pred = block->getPredecessor(i);
                 pred->insertBefore(pred->lastIns(), op);
             } else {
                 block->insertBefore(truncated->toInstruction(), op);
             }
             truncated->replaceOperand(i, op);
         }
     }