Bug 1072691: IonMonkey: Fix hoisting of operand when folding ternary structure, r=nbp

js/src/jit-test/tests/ion/bug1072691.js

@@ -0,0 +1,58 @@
+// Testcase 1.
+try {
+    function g(x) {
+        (x | 0 && 0)()
+    }
+    (function(f, s) {
+        f()
+    })(g, [])
+} catch (e) {}
+
+// Testcase 2.
+function g2(f, inputs) {
+    for (var j = 0; j < 49; ++j) {
+        for (var k = 0; k < 49; ++k) {
+            try {
+                f()
+            } catch (e) {}
+        }
+    }
+}
+function f1(x, y) {
+    (x | 0 ? Number.MAX_VALUE | 0 : x | 0)();
+};
+function f2(y) {
+    f1(y | 0)();
+};
+g2(f2, [Number])
+
+// Testcase 3.
+function h(f) {
+    for (var j = 0; j < 99; ++j) {
+        for (var k = 0; k < 99; ++k) {
+            try {
+                f()
+            } catch (e) {}
+        }
+    }
+}
+function g3(x) {
+    (x | 0 ? Number.MAX_VALUE | 0 : x | 0)
+}
+h(g3, [Number])
+
+// Testcase 4.
+function m(f) {
+    f()
+}
+function g4(x) {
+    return x ? Math.fround(-Number.MIN_VALUE) : x
+}
+m(g4)
+function h2(M) {
+    try {
+    (g4(-0 + M))()
+    } catch (e) {}
+}
+m(h2, [Math - Number])
+

js/src/jit/MIR.cpp

@@ -1227,7 +1227,7 @@ MPhi::foldsTernary()
     // - fold testArg ? 0 : testArg to 0
     if (IsNumberType(testArg->type()) && c->vp()->toNumber() == 0) {
         // When folding to the constant we need to hoist it.
-        if (trueDef == c)
+        if (trueDef == c && !c->block()->dominates(block()))
             c->block()->moveBefore(pred->lastIns(), c);
         return trueDef;
     }
@@ -1239,7 +1239,7 @@ MPhi::foldsTernary()
         c->vp()->toString() == GetIonContext()->runtime->emptyString())
     {
         // When folding to the constant we need to hoist it.
-        if (trueDef == c)
+        if (trueDef == c && !c->block()->dominates(block()))
             c->block()->moveBefore(pred->lastIns(), c);
         return trueDef;
     }