Bug 1253115 - Ion: include asm.js load/store offset in GVN (r=sunfish)

MozReview-Commit-ID: K9WS44YIBi

js/src/jit-test/tests/wasm/basic-memory.js

@@ -1,8 +1,5 @@
 load(libdir + "wasm.js");
 
-if (!wasmIsSupported())
-    quit();
-
 function testLoad(type, ext, base, offset, align, expect) {
   assertEq(wasmEvalText(
     '(module' +

js/src/jit-test/tests/wasm/memory-aliasing.js

@@ -0,0 +1,26 @@
+load(libdir + "wasm.js");
+
+var i = wasmEvalText(
+`(module
+   (memory 1 (segment 0 "\\01\\02\\03\\04\\05\\06\\07\\08"))
+   (func $off1 (param $base i32) (result i32)
+     (i32.add
+       (i32.load8_u (get_local $base))
+       (i32.load8_u offset=1 (get_local $base)))
+   )
+   (export "off1" $off1)
+   (func $off2 (param $base i32) (result i32)
+     (i32.add
+       (i32.load8_u offset=1 (get_local $base))
+       (i32.load8_u offset=2 (get_local $base)))
+   )
+   (export "off2" $off2)
+)`);
+assertEq(i.off1(0), 3);
+assertEq(i.off1(1), 5);
+assertEq(i.off1(2), 7);
+assertEq(i.off1(3), 9);
+assertEq(i.off2(0), 5);
+assertEq(i.off2(1), 7);
+assertEq(i.off2(2), 9);
+assertEq(i.off2(3), 11);

js/src/jit/MIR.cpp

@@ -4555,7 +4555,8 @@ MAsmJSLoadHeap::mightAlias(const MDefinition* def) const
         if (!base()->isConstant() || !store->base()->isConstant())
             return true;
         const MConstant* otherBase = store->base()->toConstant();
-        return base()->toConstant()->equals(otherBase);
+        return base()->toConstant()->equals(otherBase) &&
+               offset() == store->offset();
     }
     return true;
 }
@@ -4566,7 +4567,9 @@ MAsmJSLoadHeap::congruentTo(const MDefinition* ins) const
     if (!ins->isAsmJSLoadHeap())
         return false;
     const MAsmJSLoadHeap* load = ins->toAsmJSLoadHeap();
-    return load->accessType() == accessType() && congruentIfOperandsEqual(load);
+    return load->accessType() == accessType() &&
+           load->offset() == offset() &&
+           congruentIfOperandsEqual(load);
 }
 
 bool