Bug 1105574 - Range Analysis: Keep folded bitwise instructions alive for bailouts. r=sunfish

js/src/jit-test/tests/ion/bug1105574-ra-sink.js

@@ -0,0 +1,11 @@
+
+function f1(x) {
+    assertEq(Math.tan((((x >>> 0) | 0) >>> 0) | 0, f2()) < -1, !!x);
+}
+var f2 = function() { };
+
+f1(0);
+f2 = function() { };
+f1(0);
+f1(0);
+f1(-1);

js/src/jit/MIR.cpp

@@ -615,6 +615,22 @@ MDefinition::optimizeOutAllUses(TempAllocator &alloc)
     this->uses_.clear();
 }
 
+void
+MDefinition::replaceAllLiveUsesWith(MDefinition *dom)
+{
+    for (MUseIterator i(usesBegin()), e(usesEnd()); i != e; ) {
+        MUse *use = *i++;
+        MNode *consumer = use->consumer();
+        if (consumer->isResumePoint())
+            continue;
+        if (consumer->isDefinition() && consumer->toDefinition()->isRecoveredOnBailout())
+            continue;
+
+        // Update the operand to use the dominating definition.
+        use->replaceProducer(dom);
+    }
+}
+
 bool
 MDefinition::emptyResultTypeSet() const
 {

js/src/jit/MIR.h

@@ -738,6 +738,11 @@ class MDefinition : public MNode
     // be observed, and thus they should not flow in any computation.
     void optimizeOutAllUses(TempAllocator &alloc);
 
+    // Replace the current instruction by a dominating instruction |dom| in all
+    // instruction, but keep the current instruction for resume point and
+    // instruction which are recovered on bailouts.
+    void replaceAllLiveUsesWith(MDefinition *dom);
+
     // Mark this instruction as having replaced all uses of ins, as during GVN,
     // returning false if the replacement should not be performed. For use when
     // GVN eliminates instructions which are not equivalent to one another.

js/src/jit/RangeAnalysis.cpp

@@ -3038,8 +3038,10 @@ RangeAnalysis::truncate()
     for (size_t i = 0; i < bitops.length(); i++) {
         MBinaryBitwiseInstruction *ins = bitops[i];
         MDefinition *folded = ins->foldUnnecessaryBitop();
-        if (folded != ins)
-            ins->replaceAllUsesWith(folded);
+        if (folded != ins) {
+            ins->replaceAllLiveUsesWith(folded);
+            ins->setRecoveredOnBailout();
+        }
     }
 
     return true;