Backed out changeset b4300d783a34 (Bug 1239075) for 12.5% Octane-crypto regression. r=awfy

js/src/jit-test/tests/ion/bug1239075.js

@@ -1,29 +0,0 @@
-
-function g0() { with({}){}; }
-function f0(y, x) {
-    var a = y >>> 0;
-    a = a - 1 + 1;
-    g0(); // Capture the truncate result after the call.
-    var b = x / 2; // bailout.
-    return ~(a + b);
-}
-assertEq(f0(-1, 0), 0);
-assertEq(f0(-1, 1), 0);
-
-
-function g1() { with({}){}; }
-function f1(y, x) {
-    var a = y >>> 0;
-    a = a - 1 + 1;
-    g1(); // Capture the truncate result after the call.
-    var b = Math.pow(x / 2, x); // bailout.
-    return ~(a + b);
-}
-assertEq(f1(-1, 0), -1);
-assertEq(f1(-1, 1), 0);
-
-function f2(x) {
-    return ~(((~0 | 0) >>> 0 || 0) + Math.pow(Math.cos(x >>> 0), Math.atan2(0, x)))
-}
-assertEq(f2(0), -1);
-assertEq(f2(-9999), 0);

js/src/jit/RangeAnalysis.cpp

@@ -2870,7 +2870,9 @@ static MDefinition::TruncateKind
 ComputeRequestedTruncateKind(MDefinition* candidate, bool* shouldClone)
 {
     bool isCapturedResult = false;
+    bool isObservableResult = false;
     bool isRecoverableResult = true;
+    bool hasUseRemoved = candidate->isUseRemoved();
 
     MDefinition::TruncateKind kind = MDefinition::Truncate;
     for (MUseIterator use(candidate->usesBegin()); use != candidate->usesEnd(); use++) {
@@ -2880,6 +2882,8 @@ ComputeRequestedTruncateKind(MDefinition* candidate, bool* shouldClone)
             // destructive optimizations if we have no alternative. (see
             // UseRemoved flag)
             isCapturedResult = true;
+            isObservableResult = isObservableResult ||
+                use->consumer()->toResumePoint()->isObservableOperand(*use);
             isRecoverableResult = isRecoverableResult &&
                 use->consumer()->toResumePoint()->isRecoverableOperand(*use);
             continue;
@@ -2888,6 +2892,7 @@ ComputeRequestedTruncateKind(MDefinition* candidate, bool* shouldClone)
         MDefinition* consumer = use->consumer()->toDefinition();
         if (consumer->isRecoveredOnBailout()) {
             isCapturedResult = true;
+            hasUseRemoved = hasUseRemoved || consumer->isUseRemoved();
             continue;
         }
 
@@ -2912,16 +2917,24 @@ ComputeRequestedTruncateKind(MDefinition* candidate, bool* shouldClone)
     // truncation.
     if (isCapturedResult && needsConversion) {
 
-        // If the result can be recovered from all the resume points (not needed
-        // for iterating over the inlined frames), and this instruction can be
-        // recovered on bailout, then we can clone it and use the cloned
-        // instruction to encode the recover instruction.  Otherwise, we should
-        // keep the original result and bailout if the value is not in the int32
-        // range.
-        if (isRecoverableResult && candidate->canRecoverOnBailout())
+        // These optimizations are pointless if there are no removed uses or any
+        // resume point observing the result.  Not having any means that we know
+        // everything about where this results flows into.
+        if ((hasUseRemoved || (isObservableResult && isRecoverableResult)) &&
+            candidate->canRecoverOnBailout())
+        {
+            // The cloned instruction is expected to be used as a recover
+            // instruction.
             *shouldClone = true;
-        else
+
+        } else if (hasUseRemoved || isObservableResult) {
+            // 1. If uses are removed and we cannot recover the result, then we
+            // need to keep the expected result for dead branches.
+            //
+            // 2. If the result is observable and not recoverable, then the
+            // result might be read while the frame is on the stack.
             kind = Min(kind, MDefinition::TruncateAfterBailouts);
+        }
     }
 
     return kind;