diff --git a/js/src/jit-test/tests/ion/bug1894456-1.js b/js/src/jit-test/tests/ion/bug1894456-1.js new file mode 100644 index 000000000000..2b8f3e0afeb0 --- /dev/null +++ b/js/src/jit-test/tests/ion/bug1894456-1.js @@ -0,0 +1,6 @@ +var f32 = new Float32Array(1); +for (var i = 0; i < 50; i++) { + if (f32[0] != null) { + } + try {} catch {} +} diff --git a/js/src/jit-test/tests/ion/bug1894456-2.js b/js/src/jit-test/tests/ion/bug1894456-2.js new file mode 100644 index 000000000000..20b019738d62 --- /dev/null +++ b/js/src/jit-test/tests/ion/bug1894456-2.js @@ -0,0 +1,6 @@ +var f32 = new Float32Array(1); +for (var i = 0; i < 50; i++) { + if (f32[0] != undefined) { + } + try {} catch {} +} diff --git a/js/src/jit/TypePolicy.cpp b/js/src/jit/TypePolicy.cpp index 442bae54bad6..7d677bfb0605 100644 --- a/js/src/jit/TypePolicy.cpp +++ b/js/src/jit/TypePolicy.cpp @@ -229,7 +229,16 @@ bool ComparePolicy::adjustInputs(TempAllocator& alloc, switch (compare->compareType()) { case MCompare::Compare_Undefined: case MCompare::Compare_Null: - // Nothing to do for undefined and null, lowering handles all types. + MOZ_ASSERT(compare->rhs()->type() == MIRType::Undefined || + compare->rhs()->type() == MIRType::Null); + // IF the operand is float32, we must convert it to a double. + if (compare->lhs()->type() == MIRType::Float32) { + MInstruction* replace = MToDouble::New(alloc, compare->lhs()); + def->block()->insertBefore(def, replace); + def->replaceOperand(0, replace); + return replace->typePolicy()->adjustInputs(alloc, replace); + } + // GVN and lowering handle all other types. return true; case MCompare::Compare_Int32: return convertOperand(0, MIRType::Int32) &&