Bug 1314438: IonMonkey - Guard we don't remove instructions where we optimized based on its type, r=nbp

js/src/jit-test/tests/ion/bug1314438.js

@@ -0,0 +1,12 @@
+
+function f(x) {
+    return Math.pow(x, x) && 0;
+}
+f(0);
+assertEq(uneval(f(-999)), "-0");
+
+function g(x) {
+    return (-1 % x && Math.cos(8) >>> 0);
+}
+g(2);
+assertEq(uneval(g(-1)), "-0");

js/src/jit/MIR.cpp

@@ -2390,6 +2390,8 @@ MPhi::foldsTernary(TempAllocator& alloc)
     // - fold testArg ? testArg : 0 to testArg
     // - fold testArg ? 0 : testArg to 0
     if (testArg->type() == MIRType::Int32 && c->numberToDouble() == 0) {
+        testArg->setGuardRangeBailoutsUnchecked();
+
         // When folding to the constant we need to hoist it.
         if (trueDef == c && !c->block()->dominates(block()))
             c->block()->moveBefore(pred->lastIns(), c);
@@ -2922,6 +2924,9 @@ CanProduceNegativeZero(MDefinition* def)
 static inline bool
 NeedNegativeZeroCheck(MDefinition* def)
 {
+    if (def->isGuardRangeBailouts())
+        return true;
+
     // Test if all uses have the same semantics for -0 and 0
     for (MUseIterator use = def->usesBegin(); use != def->usesEnd(); use++) {
         if (use->consumer()->isResumePoint())
@@ -4388,8 +4393,7 @@ MCompare::tryFoldEqualOperands(bool* result)
             return false;
     }
 
-    if (DeadIfUnused(lhs()))
+    lhs()->setGuardRangeBailoutsUnchecked();
-        lhs()->setGuardRangeBailouts();
 
     *result = (jsop() == JSOP_STRICTEQ);
     return true;

js/src/jit/ValueNumbering.cpp

@@ -796,6 +796,9 @@ ValueNumberer::visitDefinition(MDefinition* def)
         // needed, so we can clear |def|'s guard flag and let it be discarded.
         def->setNotGuardUnchecked();
 
+        if (def->isGuardRangeBailouts())
+            sim->setGuardRangeBailoutsUnchecked();
+
         if (DeadIfUnused(def)) {
             if (!discardDefsRecursively(def))
                 return false;