Bug 1143878: IonMonkey: Test conversion of MToInt32 for testing congruence, r=jandem
authorHannes Verschore <hv1989@gmail.com>
Tue, 24 Mar 2015 23:03:32 +0100
changeset 265764 ee75ca0466a6ed61dc08c9c01ee9998337b2de96
parent 265763 3beddf2d2c8d4de0d7ec6d481f921c95b1cfdf31
child 265765 253bebf00e0ff906b68978d3d2948fc4b218133f
push id830
push userraliiev@mozilla.com
push dateFri, 19 Jun 2015 19:24:37 +0000
treeherdermozilla-release@932614382a68 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1143878
milestone39.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1143878: IonMonkey: Test conversion of MToInt32 for testing congruence, r=jandem
js/src/jit-test/tests/ion/bug1143878.js
js/src/jit/MIR.h
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1143878.js
@@ -0,0 +1,10 @@
+function f(x, y) {
+    if (!y)
+        assertEq(x == x + x, false)
+}
+m = [true, null]
+for (var j = 0; j < 2; ++j) {
+    for (var k = 0; k < 2; ++k) {
+        f(m[j], m[k])
+    }
+}
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -4968,16 +4968,18 @@ class MToInt32
         canBeNegativeZero_ = negativeZero;
     }
 
     MacroAssembler::IntConversionInputKind conversion() const {
         return conversion_;
     }
 
     bool congruentTo(const MDefinition *ins) const override {
+        if (!ins->isToInt32() || ins->toToInt32()->conversion() != conversion())
+            return false;
         return congruentIfOperandsEqual(ins);
     }
 
     AliasSet getAliasSet() const override {
         return AliasSet::None();
     }
     void computeRange(TempAllocator &alloc) override;
     void collectRangeInfoPreTrunc() override;