Bug 1062612 - IonMonkey: Fix cast insertion for truncation of phi operands. r=nbp, a=lmandel
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1062612.js
@@ -0,0 +1,7 @@
+x = [0, 1, 1, 0, 1, 1];
+y = -1;
+sum = 0;
+for (var j = 0; j < x.length; ++j) {
+ sum = sum + (x[j] ? 0 : (y >>> 0)) | 0;
+}
+assertEq(sum, -2);
--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -2613,17 +2613,17 @@ AdjustTruncatedInputs(TempAllocator &all
} else {
MInstruction *op;
if (kind == MDefinition::TruncateAfterBailouts)
op = MToInt32::New(alloc, truncated->getOperand(i));
else
op = MTruncateToInt32::New(alloc, truncated->getOperand(i));
if (truncated->isPhi()) {
- MBasicBlock *pred = op->block()->getPredecessor(i);
+ MBasicBlock *pred = block->getPredecessor(i);
pred->insertBefore(pred->lastIns(), op);
} else {
block->insertBefore(truncated->toInstruction(), op);
}
truncated->replaceOperand(i, op);
}
}