Don't clobber compared FP registers when syncing before a double comparison, bug 716119. r=dvander

js/src/methodjit/FastArithmetic.cpp

@@ -1432,13 +1432,24 @@ mjit::Compiler::jsop_relational_double(JSOp op, BoolStub stub, jsbytecode *targe
         stubcc.leave();
         OOL_STUBCALL(stub, REJOIN_BRANCH);
 
+        if (!allocateLeft)
+            frame.pinReg(fpLeft);
+        if (!allocateRight)
+            frame.pinReg(fpRight);
+
         frame.syncAndKillEverything();
+
         Jump j = masm.branchDouble(dblCond, fpLeft, fpRight);
 
         if (allocateLeft)
             frame.freeReg(fpLeft);
+        else
+            frame.unpinKilledReg(fpLeft);
+
         if (allocateRight)
             frame.freeReg(fpRight);
+        else
+            frame.unpinKilledReg(fpRight);
 
         frame.popn(2);
 

js/src/methodjit/FrameState-inl.h

@@ -1282,7 +1282,7 @@ FrameState::getCallee()
 }
 
 inline void
-FrameState::unpinKilledReg(RegisterID reg)
+FrameState::unpinKilledReg(AnyRegisterID reg)
 {
     regstate(reg).unpinUnsafe();
     freeRegs.putReg(reg);

js/src/methodjit/FrameState.cpp

@@ -1498,10 +1498,11 @@ FrameState::syncAndKill(Registers kill, Uses uses, Uses ignore)
         if (!fe || deadEntry(fe, ignore.nuses))
             continue;
 
-        JS_ASSERT(fe->isTracked() && !fe->isType(JSVAL_TYPE_DOUBLE));
+        JS_ASSERT(fe->isTracked());
 
         if (regstate(reg).type() == RematInfo::DATA) {
-            JS_ASSERT(fe->data.reg() == reg.reg());
+            JS_ASSERT_IF(reg.isFPReg(), fe->data.fpreg() == reg.fpreg());
+            JS_ASSERT_IF(!reg.isFPReg(), fe->data.reg() == reg.reg());
             JS_ASSERT(fe->data.synced());
             fe->data.setMemory();
         } else {

js/src/methodjit/FrameState.h

@@ -806,7 +806,7 @@ class FrameState
     /*
      * Same as unpinReg(), but does not restore the FrameEntry.
      */
-    inline void unpinKilledReg(RegisterID reg);
+    inline void unpinKilledReg(AnyRegisterID reg);
 
     /* Pins a data or type register if one exists. */
     MaybeRegisterID maybePinData(FrameEntry *fe);