Bug 804064 - TableSwitchV, unbox integers values before branching. r=h4writer
☠☠ backed out by cdaa193babf2 ☠ ☠
authorNicolas B. Pierron <nicolas.b.pierron@mozilla.com>
Mon, 29 Oct 2012 22:28:47 -0700
changeset 111870 4770ab40cdb6c798b2eb563abaf7ccee98e0c562
parent 111869 561c637077fa4d222d2d8471a75d380fa390b24d
child 111871 f75e5dcdbb44e549941628be640d055f689de278
push id93
push usernmatsakis@mozilla.com
push dateWed, 31 Oct 2012 21:26:57 +0000
reviewersh4writer
bugs804064
milestone19.0a1
Bug 804064 - TableSwitchV, unbox integers values before branching. r=h4writer
js/src/ion/CodeGenerator.cpp
js/src/jit-test/tests/ion/bug804064.js
--- a/js/src/ion/CodeGenerator.cpp
+++ b/js/src/ion/CodeGenerator.cpp
@@ -387,23 +387,28 @@ CodeGenerator::visitTableSwitchV(LTableS
     MTableSwitch *mir = ins->mir();
     Label *defaultcase = mir->getDefault()->lir()->label();
 
     Register index = ToRegister(ins->tempInt());
     ValueOperand value = ToValue(ins, LTableSwitchV::InputValue);
     Register tag = masm.extractTag(value, index);
     masm.branchTestNumber(Assembler::NotEqual, tag, defaultcase);
 
-    Label isInt;
-    masm.branchTestInt32(Assembler::Equal, tag, &isInt);
+    Label unboxInt, isInt;
+    masm.branchTestInt32(Assembler::Equal, tag, &unboxInt);
     {
         FloatRegister floatIndex = ToFloatRegister(ins->tempFloat());
         masm.unboxDouble(value, floatIndex);
         emitDoubleToInt32(floatIndex, index, defaultcase, false);
+        masm.jmp(&isInt);
     }
+
+    masm.bind(&unboxInt);
+    masm.unboxInt32(value, index);
+
     masm.bind(&isInt);
 
     return emitTableSwitchDispatch(mir, index, ToRegisterOrInvalid(ins->tempPointer()));
 }
 
 bool
 CodeGenerator::visitParameter(LParameter *lir)
 {
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug804064.js
@@ -0,0 +1,18 @@
+function f (v, i) {
+    var c = v[i];
+    switch (c) {
+    case 0:
+        assertEq(v[i], 0);
+        break;
+    case 1:
+        assertEq(v[i], 1);
+        break;
+    default:
+        if (c == 0 || c == 1)
+            assertEq(c, false);
+    }
+}
+
+var v = [0, 0.0, 0.1, 1, 1.0, 1.1, null, undefined];
+for (var i = 0; i < 100; i++)
+    f(v, i % v.length);