Bug 889186: IonMonkey: When optimizing a compare mark replaced operands correspondingly as being folded, r=bhackett

This commit is contained in:
Hannes Verschore 2013-07-10 22:48:25 +02:00
parent 07d9a40564
commit c52be22933
2 changed files with 12 additions and 2 deletions

View File

@ -1565,10 +1565,14 @@ MCompare::infer(JSContext *cx, BaselineInspector *inspector, jsbytecode *pc)
// now unwrapped operand is an int32.
MDefinition *newlhs, *newrhs;
if (MustBeUInt32(getOperand(0), &newlhs) && MustBeUInt32(getOperand(1), &newrhs)) {
if (newlhs != getOperand(0))
if (newlhs != getOperand(0)) {
getOperand(0)->setFoldedUnchecked();
replaceOperand(0, newlhs);
if (newrhs != getOperand(1))
}
if (newrhs != getOperand(1)) {
getOperand(1)->setFoldedUnchecked();
replaceOperand(1, newrhs);
}
compareType_ = Compare_UInt32;
return;
}

View File

@ -0,0 +1,6 @@
function f()
{
return (4 >>> 0) > ((0 % (1 == 2)) >>> 0);
}
assertEq(f(), true);
assertEq(f(), true);