Bug 930477: Follow-up - Don't allow the power type to be Float32 for MPow; r=h4writer
authorBenjamin Bouvier <benj@benj.me>
Fri, 21 Feb 2014 11:37:27 +0100
changeset 170181 9ac8d347e6c68e8bc9d7140b6eb9b7f9a90a5175
parent 170180 147db60f29113783f8b77e6c832ca89e988d3379
child 170182 775c66270625c26dc182c2e969f041ed0e4ec6ab
push id270
push userpvanderbeken@mozilla.com
push dateThu, 06 Mar 2014 09:24:21 +0000
reviewersh4writer
bugs930477
milestone30.0a1
Bug 930477: Follow-up - Don't allow the power type to be Float32 for MPow; r=h4writer
js/src/jit-test/tests/ion/bug975290.js
js/src/jit/MCallOptimize.cpp
js/src/jit/MIR.h
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug975290.js
@@ -0,0 +1,6 @@
+for (var j = 0; j < 9999; ++j) {
+    (function() {
+        Math.pow(Math.fround(), Math.fround(0))
+    })();
+}
+
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -837,16 +837,18 @@ IonBuilder::inlineMathPow(CallInfo &call
             MMul *mul = MMul::New(alloc(), y, y, outputType);
             current->add(mul);
             output = mul;
         }
     }
 
     // Use MPow for other powers
     if (!output) {
+        if (powerType == MIRType_Float32)
+            powerType = MIRType_Double;
         MPow *pow = MPow::New(alloc(), base, power, powerType);
         current->add(pow);
         output = pow;
     }
 
     // Cast to the right type
     if (outputType == MIRType_Int32 && output->type() != MIRType_Int32) {
         MToInt32 *toInt = MToInt32::New(alloc(), output);
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -3747,16 +3747,17 @@ class MPow
         setMovable();
     }
 
   public:
     INSTRUCTION_HEADER(Pow)
     static MPow *New(TempAllocator &alloc, MDefinition *input, MDefinition *power,
                      MIRType powerType)
     {
+        JS_ASSERT(powerType == MIRType_Double || powerType == MIRType_Int32);
         return new(alloc) MPow(input, power, powerType);
     }
 
     MDefinition *input() const {
         return lhs();
     }
     MDefinition *power() const {
         return rhs();