Bug 756247 - Fix JSOP_POS inference failure. r=dvander

js/src/ion/IonBuilder.cpp

@@ -2558,26 +2558,18 @@ bool
 IonBuilder::jsop_pos()
 {
     TypeOracle::Unary types = oracle->unaryOp(script, pc);
-    MDefinition *value = current->pop();
-    if (types.ival == MIRType_Int32) {
-        // Already an int32, no semantic difference!
-        current->push(value);
+    if (IsNumberType(types.ival)) {
+        // Already int32 or double.
+        JS_ASSERT(types.ival == types.rval);
         return true;
     }
 
-    MToDouble *ins = MToDouble::New(value);
-    current->add(ins);
-    current->push(ins);
+    // Compile +x as x * 1.
+    MDefinition *value = current->pop();
+    MConstant *one = MConstant::New(Int32Value(1));
+    current->add(one);
 
-    // If the expected type is >= string, we compile this as a more expensive
-    // variant and consider it effectful.
-    if (types.ival >= MIRType_String) {
-       ins->unspecialize();
-       if (!resumeAfter(ins))
-           return false;
-    }
-
-    return true;
+    return jsop_binary(JSOP_MUL, value, one);
 }
 
 bool

js/src/ion/MIR.h

@@ -1571,8 +1571,7 @@ class MPassArg
 // Converts a primitive (either typed or untyped) to a double. If the input is
 // not primitive at runtime, a bailout occurs.
 class MToDouble
-  : public MUnaryInstruction,
-    public SimplePolicy
+  : public MUnaryInstruction
 {
     MToDouble(MDefinition *def)
       : MUnaryInstruction(def)
@@ -1596,12 +1595,7 @@ class MToDouble
         return congruentIfOperandsEqual(ins);
     }
     AliasSet getAliasSet() const {
-        return specialized()
-               ? AliasSet::None()
-               : AliasSet::Store(AliasSet::Any);
-    }
-    TypePolicy *typePolicy() {
-        return this;
+        return AliasSet::None();
     }
 };
 

js/src/ion/TypeOracle.cpp

@@ -103,7 +103,7 @@ TypeInferenceOracle::binaryTypes(JSScript *script, jsbytecode *pc)
     JSOp op = (JSOp)*pc;
 
     BinaryTypes res;
-    if ((js_CodeSpec[op].format & JOF_INCDEC) || op == JSOP_NEG) {
+    if ((js_CodeSpec[op].format & JOF_INCDEC) || op == JSOP_NEG || op == JSOP_POS) {
         res.lhsTypes = script->analysis()->poppedTypes(pc, 0);
         res.rhsTypes = NULL;
         res.outTypes = script->analysis()->pushedTypes(pc, 0);
@@ -134,7 +134,7 @@ TypeInferenceOracle::binaryOp(JSScript *script, jsbytecode *pc)
     JSOp op = (JSOp)*pc;
 
     Binary res;
-    if ((js_CodeSpec[op].format & JOF_INCDEC) || op == JSOP_NEG) {
+    if ((js_CodeSpec[op].format & JOF_INCDEC) || op == JSOP_NEG || op == JSOP_POS) {
         res.lhs = getMIRType(script->analysis()->poppedTypes(pc, 0));
         res.rhs = MIRType_Int32;
         res.rval = getMIRType(script->analysis()->pushedTypes(pc, 0));

js/src/jit-test/tests/ion/bug756247.js

@@ -0,0 +1,13 @@
+function foo(i) {
+    var n = 0;
+    for (var i = 0; i < false; i++)
+        n = a++;
+    assertEq(n, 0);
+}
+var a = foo(10);
+
+function bar(x) {
+    var y = +(x ? x : "foo");
+    assertEq(y, 10);
+}
+bar(10);