Bug 1279898: IonMonkey - Don't run TI alias analysis on typed objects/arrays, r=jandem, a=lizzard
authorHannes Verschore <hv1989@gmail.com>
Tue, 21 Jun 2016 13:52:11 +0200
changeset 341761 39a99836d414fbb7903484ad6fbfee6b123b8abc
parent 341760 a720069003b6eabfe0d347ad4c14e9649d21e017
child 341762 0260659187b2869d7ee9193cd5f8588d4f763329
push id1183
push userraliiev@mozilla.com
push dateMon, 05 Sep 2016 20:01:49 +0000
treeherdermozilla-release@3148731bed45 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, lizzard
bugs1279898
milestone49.0a2
Bug 1279898: IonMonkey - Don't run TI alias analysis on typed objects/arrays, r=jandem, a=lizzard
js/src/jit-test/tests/ion/bug1279898.js
js/src/jit/AliasAnalysisShared.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1279898.js
@@ -0,0 +1,19 @@
+
+function f() {
+    var i32 = new Int32Array(1);
+    var f32 = new Float32Array(i32.buffer);
+    for (var i = 0; i < 3; i++) {
+        var a0 = +1;
+        var a3 = +4;
+
+        i32[0] = a0;
+        var b0 = f32[0];
+
+        i32[0] = a3;
+        var b3 = f32[0];
+
+        assertEq(b0 != b3, true);
+    }
+}
+
+f();
--- a/js/src/jit/AliasAnalysisShared.cpp
+++ b/js/src/jit/AliasAnalysisShared.cpp
@@ -42,23 +42,25 @@ AliasAnalysisShared::spewDependencyList(
 #endif
 }
 
 // Unwrap any slot or element to its corresponding object.
 static inline const MDefinition*
 MaybeUnwrap(const MDefinition* object)
 {
 
-    while (object->isSlots() || object->isElements() || object->isConvertElementsToDoubles() ||
-           object->isTypedArrayElements() || object->isTypedObjectElements())
-    {
+    while (object->isSlots() || object->isElements() || object->isConvertElementsToDoubles()) {
         MOZ_ASSERT(object->numOperands() == 1);
         object = object->getOperand(0);
     }
 
+    if (object->isTypedArrayElements())
+        return nullptr;
+    if (object->isTypedObjectElements())
+        return nullptr;
     if (object->isConstantElements())
         return nullptr;
 
     return object;
 }
 
 // Get the object of any load/store. Returns nullptr if not tied to
 // an object.