Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-15 06:15:43 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1079062 - IonMonkey: Don't fold ternary constructs, when a branch dominates both MPhi predecessors, r=nbp

Browse Source
This commit is contained in:
Hannes Verschore 2014-10-08 10:06:10 +02:00
parent 0b49e3b3fd
commit 2bfe1d5e36
2 changed files with 29 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
js/src/jit-test/tests/ion/bug1079062.js Normal file
View File

@ -0,0 +1,6 @@
function f(y) {
return ((y ? y : 0) ? 0 : y)
}
m = [0xf]
f(m[0])
assertEq(f(m[0]), 0)

24
js/src/jit/MIR.cpp
View File

@ -1222,8 +1222,30 @@ MPhi::foldsTernary()
if (!pred || !pred->lastIns()->isTest())
return nullptr;
// We found a ternary construct.
MTest *test = pred->lastIns()->toTest();
// True branch may only dominate one edge of MPhi.
if (test->ifTrue()->dominates(block()->getPredecessor(0)) &&
test->ifTrue()->dominates(block()->getPredecessor(1)))
{
return nullptr;
}
// False branch may only dominate one edge of MPhi.
if (test->ifFalse()->dominates(block()->getPredecessor(0)) &&
test->ifFalse()->dominates(block()->getPredecessor(1)))
{
return nullptr;
}
// True and false branch must dominate different edges of MPhi.
if (test->ifTrue()->dominates(block()->getPredecessor(0)) ==
test->ifFalse()->dominates(block()->getPredecessor(0)))
{
return nullptr;
}
// We found a ternary construct.
bool firstIsTrueBranch = test->ifTrue()->dominates(block()->getPredecessor(0));
MDefinition *trueDef = firstIsTrueBranch ? getOperand(0) : getOperand(1);
MDefinition *falseDef = firstIsTrueBranch ? getOperand(1) : getOperand(0);