From 22efc12d228ec3c3d8dd486c3a0d551b75c43694 Mon Sep 17 00:00:00 2001
From: Luke Wagner <luke@mozilla.com>
Date: Sun, 6 Mar 2016 17:46:22 -0600
Subject: [PATCH] Bug 1253115 - Ion: include asm.js load/store offset in GVN
 (r=sunfish)

MozReview-Commit-ID: K9WS44YIBi
---
 js/src/jit-test/tests/wasm/basic-memory.js    |  3 ---
 js/src/jit-test/tests/wasm/memory-aliasing.js | 26 +++++++++++++++++++
 js/src/jit/MIR.cpp                            |  7 +++--
 3 files changed, 31 insertions(+), 5 deletions(-)
 create mode 100644 js/src/jit-test/tests/wasm/memory-aliasing.js

diff --git a/js/src/jit-test/tests/wasm/basic-memory.js b/js/src/jit-test/tests/wasm/basic-memory.js
index 39a6096b9d86..eb7ced53805f 100644
--- a/js/src/jit-test/tests/wasm/basic-memory.js
+++ b/js/src/jit-test/tests/wasm/basic-memory.js
@@ -1,8 +1,5 @@
 load(libdir + "wasm.js");
 
-if (!wasmIsSupported())
-    quit();
-
 function testLoad(type, ext, base, offset, align, expect) {
   assertEq(wasmEvalText(
     '(module' +
diff --git a/js/src/jit-test/tests/wasm/memory-aliasing.js b/js/src/jit-test/tests/wasm/memory-aliasing.js
new file mode 100644
index 000000000000..84eecdaec1e2
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/memory-aliasing.js
@@ -0,0 +1,26 @@
+load(libdir + "wasm.js");
+
+var i = wasmEvalText(
+`(module
+   (memory 1 (segment 0 "\\01\\02\\03\\04\\05\\06\\07\\08"))
+   (func $off1 (param $base i32) (result i32)
+     (i32.add
+       (i32.load8_u (get_local $base))
+       (i32.load8_u offset=1 (get_local $base)))
+   )
+   (export "off1" $off1)
+   (func $off2 (param $base i32) (result i32)
+     (i32.add
+       (i32.load8_u offset=1 (get_local $base))
+       (i32.load8_u offset=2 (get_local $base)))
+   )
+   (export "off2" $off2)
+)`);
+assertEq(i.off1(0), 3);
+assertEq(i.off1(1), 5);
+assertEq(i.off1(2), 7);
+assertEq(i.off1(3), 9);
+assertEq(i.off2(0), 5);
+assertEq(i.off2(1), 7);
+assertEq(i.off2(2), 9);
+assertEq(i.off2(3), 11);
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index 43557a5e71a5..aabd4348469e 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -4555,7 +4555,8 @@ MAsmJSLoadHeap::mightAlias(const MDefinition* def) const
         if (!base()->isConstant() || !store->base()->isConstant())
             return true;
         const MConstant* otherBase = store->base()->toConstant();
-        return base()->toConstant()->equals(otherBase);
+        return base()->toConstant()->equals(otherBase) &&
+               offset() == store->offset();
     }
     return true;
 }
@@ -4566,7 +4567,9 @@ MAsmJSLoadHeap::congruentTo(const MDefinition* ins) const
     if (!ins->isAsmJSLoadHeap())
         return false;
     const MAsmJSLoadHeap* load = ins->toAsmJSLoadHeap();
-    return load->accessType() == accessType() && congruentIfOperandsEqual(load);
+    return load->accessType() == accessType() &&
+           load->offset() == offset() &&
+           congruentIfOperandsEqual(load);
 }
 
 bool