From 00976485900ba739fbbd9b4514750de4e47440a5 Mon Sep 17 00:00:00 2001
From: David Mandelin <dmandelin@mozilla.com>
Date: Thu, 19 May 2011 10:55:36 -0700
Subject: [PATCH] Bug 652054: tweak register allocation for 64-bit stores,
 r=njn

--HG--
extra : rebase_source : 799b60cac94e5d4a3ce087e18ac92416fd6a5414
---
 js/src/jit-test/tests/basic/bug652054.js | 55 ++++++++++++++++++++++++
 js/src/nanojit/NativeX64.cpp             |  7 ++-
 2 files changed, 60 insertions(+), 2 deletions(-)
 create mode 100644 js/src/jit-test/tests/basic/bug652054.js

diff --git a/js/src/jit-test/tests/basic/bug652054.js b/js/src/jit-test/tests/basic/bug652054.js
new file mode 100644
index 00000000000..9c43865a88b
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug652054.js
@@ -0,0 +1,55 @@
+var M4x4 = {};
+M4x4.mul = function M4x4_mul(a, b, r) {
+    a11 = a[0]
+    a21 = a[1]
+    a31 = a[2]
+    a12 = a[4]
+    a22 = a[5]
+    a32 = a[6]
+    a13 = a[8]
+    a23 = a[9]
+    a33 = a[10]
+    a14 = a[12]
+    a24 = a[13]
+    a34 = a[14]
+    b[3]
+    b[4]
+    b13 = b[8]
+    b23 = b[9]
+    b33 = b[10]
+    b43 = b[11]
+    r[8] = a11 * b13 + a12 * b23 + a13 * b33 + a14 * b43
+    r[9] = a21 * b13 + a22 * b23 + a23 * b33 + a24 * b43
+    r[10] = a31 * b13 + a32 * b23 + a33 * b33 + a34 * b43
+    return r;
+};
+M4x4.scale3 = function M4x4_scale3(x, y, z, m) {
+    m[0] *= x;
+    m[3] *= x;
+    m[4] *= y;
+    m[11] *= z;
+};
+M4x4.makeLookAt = function M4x4_makeLookAt() {
+    tm1 = Float32Array(16);
+    tm2 = Float32Array(16);
+    r = new Float32Array(16)
+    return M4x4.mul(tm1, tm2, r);
+};
+var jellyfish = {};
+jellyfish.order = [];
+function jellyfishInstance() {}
+jellyfishInstance.prototype.drawShadow = function () {
+    pMatrix = M4x4.makeLookAt();
+    M4x4.mul(M4x4.makeLookAt(), pMatrix, pMatrix);
+    M4x4.scale3(6, 180, 0, pMatrix);
+}
+function drawScene() {
+    jellyfish.order.push([0, 0])
+    jellyfish[0] = new jellyfishInstance()
+    for (var i = 0, j = 0; i < jellyfish.count, j < 30; ++j) {
+        jellyfish.order[i][0]
+        jellyfish[0].drawShadow();
+    }
+}
+drawScene();
+
diff --git a/js/src/nanojit/NativeX64.cpp b/js/src/nanojit/NativeX64.cpp
index 18e6ba1321a..fc0e70b498b 100644
--- a/js/src/nanojit/NativeX64.cpp
+++ b/js/src/nanojit/NativeX64.cpp
@@ -493,7 +493,7 @@ namespace nanojit
     void Assembler::CVTSQ2SD(R l, R r)  { emitprr(X64_cvtsq2sd,l,r); asm_output("cvtsq2sd %s, %s",RQ(l),RQ(r)); }
     void Assembler::CVTSI2SD(R l, R r)  { emitprr(X64_cvtsi2sd,l,r); asm_output("cvtsi2sd %s, %s",RQ(l),RL(r)); }
     void Assembler::CVTSS2SD(R l, R r)  { emitprr(X64_cvtss2sd,l,r); asm_output("cvtss2sd %s, %s",RQ(l),RL(r)); }
-    void Assembler::CVTSD2SS(R l, R r)  { emitprr(X64_cvtsd2ss,l,r); asm_output("cvtsd2ss %s, %s",RL(l),RQ(r)); }
+    void Assembler::CVTSD2SS(R l, R r)  { emitprr(X64_cvtsd2ss,l,r); asm_output("cvtsd2ss %s, %s",RQ(l),RQ(r)); }
     void Assembler::CVTSD2SI(R l, R r)  { emitprr(X64_cvtsd2si,l,r); asm_output("cvtsd2si %s, %s",RL(l),RQ(r)); }
     void Assembler::CVTTSD2SI(R l, R r) { emitprr(X64_cvttsd2si,l,r);asm_output("cvttsd2si %s, %s",RL(l),RQ(r));}
     void Assembler::UCOMISD( R l, R r)  { emitprr(X64_ucomisd, l,r); asm_output("ucomisd %s, %s", RQ(l),RQ(r)); }
@@ -1727,9 +1727,12 @@ namespace nanojit
                 break;
             }
             case LIR_std2f: {
-                Register b = getBaseReg(base, d, BaseRegs);
                 Register r = findRegFor(value, FpRegs);
                 Register t = registerAllocTmp(FpRegs & ~rmask(r));
+                // Here, it is safe to call getBaseReg after registerAllocTmp
+                // because BaseRegs does not overlap with FpRegs, so getBaseReg
+                // will not allocate register |t|.
+                Register b = getBaseReg(base, d, BaseRegs);
 
                 MOVSSMR(t, d, b);   // store
                 CVTSD2SS(t, r);     // cvt to single-precision