Bug 1143878 - IonMonkey: Test conversion of MToInt32 for testing congruence. r=jandem, a=sledru
authorHannes Verschore <hv1989@gmail.com>
Tue, 24 Mar 2015 23:03:32 +0100
changeset 260227 0b3c5b65610e
parent 260226 5f0e381a7afd
child 260228 a9be9167d92b
push id723
push userryanvm@gmail.com
push date2015-04-22 14:15 +0000
treeherdermozilla-release@22f8fa3a9273 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, sledru
bugs1143878
milestone38.0
Bug 1143878 - IonMonkey: Test conversion of MToInt32 for testing congruence. r=jandem, a=sledru
js/src/jit-test/tests/ion/bug1143878.js
js/src/jit/MIR.h
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1143878.js
@@ -0,0 +1,10 @@
+function f(x, y) {
+    if (!y)
+        assertEq(x == x + x, false)
+}
+m = [true, null]
+for (var j = 0; j < 2; ++j) {
+    for (var k = 0; k < 2; ++k) {
+        f(m[j], m[k])
+    }
+}
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -4762,16 +4762,18 @@ class MToInt32
         canBeNegativeZero_ = negativeZero;
     }
 
     MacroAssembler::IntConversionInputKind conversion() const {
         return conversion_;
     }
 
     bool congruentTo(const MDefinition* ins) const override {
+        if (!ins->isToInt32() || ins->toToInt32()->conversion() != conversion())
+            return false;
         return congruentIfOperandsEqual(ins);
     }
 
     AliasSet getAliasSet() const override {
         return AliasSet::None();
     }
     void computeRange(TempAllocator& alloc) override;
     void collectRangeInfoPreTrunc() override;