From b2f56a0473a40598ac29dc6340ed39b449abe22c Mon Sep 17 00:00:00 2001
From: Benjamin Bouvier <benj@benj.me>
Date: Mon, 3 Feb 2014 18:22:40 +0100
Subject: [PATCH] Bug 966926: Force ToString not to have Float32 inputs;
 r=h4writer

--HG--
extra : rebase_source : beef551756493a697923db13607f41a3680c1eb6
---
 js/src/jit-test/tests/ion/bug966926.js | 12 ++++++++++++
 js/src/jit/TypePolicy.cpp              | 25 ++++++++++++++-----------
 2 files changed, 26 insertions(+), 11 deletions(-)
 create mode 100644 js/src/jit-test/tests/ion/bug966926.js

diff --git a/js/src/jit-test/tests/ion/bug966926.js b/js/src/jit-test/tests/ion/bug966926.js
new file mode 100644
index 000000000000..204a35c4eb8f
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug966926.js
@@ -0,0 +1,12 @@
+var f32 = new Float32Array(32);
+function f(n) {
+    var x;
+    if (n > 10000) {
+        x = (0);
+    } else {
+        x = f32[0];
+    }
+    g('' + (x));
+}
+function g(y){}
+f(0);
diff --git a/js/src/jit/TypePolicy.cpp b/js/src/jit/TypePolicy.cpp
index b423a8954bfc..34d142c3bbb1 100644
--- a/js/src/jit/TypePolicy.cpp
+++ b/js/src/jit/TypePolicy.cpp
@@ -15,6 +15,17 @@ using namespace js::jit;
 
 using JS::DoubleNaNValue;
 
+static void
+EnsureOperandNotFloat32(TempAllocator &alloc, MInstruction *def, unsigned op)
+{
+    MDefinition *in = def->getOperand(op);
+    if (in->type() == MIRType_Float32) {
+        MToDouble *replace = MToDouble::New(alloc, in);
+        def->block()->insertBefore(def, replace);
+        def->replaceOperand(op, replace);
+    }
+}
+
 MDefinition *
 BoxInputsPolicy::boxAt(TempAllocator &alloc, MInstruction *at, MDefinition *operand)
 {
@@ -409,6 +420,9 @@ ConvertToStringPolicy<Op>::staticAdjustInputs(TempAllocator &alloc, MInstruction
 
         replace = MUnbox::New(alloc, in, MIRType_String, MUnbox::Fallible);
     } else {
+        // TODO remove these two lines once 966957 has landed
+        EnsureOperandNotFloat32(alloc, ins, Op);
+        in = ins->getOperand(Op);
         replace = MToString::New(alloc, in);
     }
 
@@ -522,17 +536,6 @@ template bool Float32Policy<0>::staticAdjustInputs(TempAllocator &alloc, MInstru
 template bool Float32Policy<1>::staticAdjustInputs(TempAllocator &alloc, MInstruction *def);
 template bool Float32Policy<2>::staticAdjustInputs(TempAllocator &alloc, MInstruction *def);
 
-static void
-EnsureOperandNotFloat32(TempAllocator &alloc, MInstruction *def, unsigned op)
-{
-    MDefinition *in = def->getOperand(op);
-    if (in->type() == MIRType_Float32) {
-        MToDouble *replace = MToDouble::New(alloc, in);
-        def->block()->insertBefore(def, replace);
-        def->replaceOperand(op, replace);
-    }
-}
-
 template <unsigned Op>
 bool
 NoFloatPolicy<Op>::staticAdjustInputs(TempAllocator &alloc, MInstruction *def)