Bug 1143878: IonMonkey: Test conversion of MToInt32 for testing congruence, r=jandem
authorHannes Verschore <hv1989@gmail.com>
Tue, 24 Mar 2015 23:03:32 +0100
changeset 264302 ee75ca0466a6ed61dc08c9c01ee9998337b2de96
parent 264301 3beddf2d2c8d4de0d7ec6d481f921c95b1cfdf31
child 264303 253bebf00e0ff906b68978d3d2948fc4b218133f
push id4718
push userraliiev@mozilla.com
push dateMon, 11 May 2015 18:39:53 +0000
treeherdermozilla-beta@c20c4ef55f08 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1143878
milestone39.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1143878: IonMonkey: Test conversion of MToInt32 for testing congruence, r=jandem
js/src/jit-test/tests/ion/bug1143878.js
js/src/jit/MIR.h
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1143878.js
@@ -0,0 +1,10 @@
+function f(x, y) {
+    if (!y)
+        assertEq(x == x + x, false)
+}
+m = [true, null]
+for (var j = 0; j < 2; ++j) {
+    for (var k = 0; k < 2; ++k) {
+        f(m[j], m[k])
+    }
+}
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -4968,16 +4968,18 @@ class MToInt32
         canBeNegativeZero_ = negativeZero;
     }
 
     MacroAssembler::IntConversionInputKind conversion() const {
         return conversion_;
     }
 
     bool congruentTo(const MDefinition *ins) const override {
+        if (!ins->isToInt32() || ins->toToInt32()->conversion() != conversion())
+            return false;
         return congruentIfOperandsEqual(ins);
     }
 
     AliasSet getAliasSet() const override {
         return AliasSet::None();
     }
     void computeRange(TempAllocator &alloc) override;
     void collectRangeInfoPreTrunc() override;