Bug 1120069 - Recover_TruncateToInt32: Change ToNumber() to ToInt32() for value range analysis. r=nbp

--HG--
extra : rebase_source : 55a09b5386a64c379d90819156f9bee32f98379c
This commit is contained in:
ZongShen Shen 2015-01-26 09:08:17 -08:00
parent 3fdf89dee9
commit e36c37b59c

View File

@ -6,6 +6,7 @@
#include "jit/Recover.h"
#include "jsapi.h"
#include "jscntxt.h"
#include "jsmath.h"
#include "jsobj.h"
@ -1142,12 +1143,11 @@ RTruncateToInt32::recover(JSContext *cx, SnapshotIterator &iter) const
RootedValue value(cx, iter.read());
RootedValue result(cx);
double in;
if (!ToNumber(cx, value, &in))
int32_t trunc;
if (!JS::ToInt32(cx, value, &trunc))
return false;
int out = ToInt32(in);
result.setInt32(out);
result.setInt32(trunc);
iter.storeInstructionResult(result);
return true;
}