Bug 1107011: Propagate recovered on bailout flags when converting float32 to doubles; r=nbp
authorBenjamin Bouvier <benj@benj.me>
Thu, 10 Sep 2015 11:58:44 +0200
changeset 294884 fb1f0c400ec04e49840b1bf68efa98c50b01c952
parent 294883 e91af2be3c3e384a619839cc28a7e8f81a9d0d43
child 294885 0456de3eb5e3c36db7b17338c40d573f66773b04
push id5245
push userraliiev@mozilla.com
push dateThu, 29 Oct 2015 11:30:51 +0000
treeherdermozilla-beta@dac831dc1bd0 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnbp
bugs1107011
milestone43.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1107011: Propagate recovered on bailout flags when converting float32 to doubles; r=nbp
js/src/jit-test/tests/ion/bug1107011-1.js
js/src/jit-test/tests/ion/bug1107011-2.js
js/src/jit/TypePolicy.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1107011-1.js
@@ -0,0 +1,17 @@
+var f32 = new Float32Array(32);
+function f(n) {
+    var x;
+    if (n > 10000) {
+        x = 4.5;
+    } else {
+        x = f32[0];
+    }
+    f32[0] = (function() {
+        for(var f=0;f<4;++f) {
+            x=1;
+        }
+    })() < x;
+}
+for (var n = 0; n < 100; n++)
+    f(n);
+
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1107011-2.js
@@ -0,0 +1,12 @@
+function foo() {
+    var x = 0, y = 0, a = new Float32Array(1);
+    function bar() {
+        x = y;
+        y = a[0];
+    }
+    for (var i = 0; i < 1000; i++) {
+        bar();
+    }
+}
+for (var i=0; i<10000; i++)
+    foo();
--- a/js/src/jit/TypePolicy.cpp
+++ b/js/src/jit/TypePolicy.cpp
@@ -19,16 +19,18 @@ using JS::DoubleNaNValue;
 
 static void
 EnsureOperandNotFloat32(TempAllocator& alloc, MInstruction* def, unsigned op)
 {
     MDefinition* in = def->getOperand(op);
     if (in->type() == MIRType_Float32) {
         MToDouble* replace = MToDouble::New(alloc, in);
         def->block()->insertBefore(def, replace);
+        if (def->isRecoveredOnBailout())
+            replace->setRecoveredOnBailout();
         def->replaceOperand(op, replace);
     }
 }
 
 MDefinition*
 js::jit::AlwaysBoxAt(TempAllocator& alloc, MInstruction* at, MDefinition* operand)
 {
     MDefinition* boxedOperand = operand;