Bug 862100: IonMonkey: AddTypeBarrier shouldn't unbox, when type is already double, r=nbp

js/src/ion/IonBuilder.cpp

@@ -3088,23 +3088,23 @@ IonBuilder::addTypeBarrier(uint32_t i, CallInfo &callinfo, types::StackTypeSet *
                 // types should remain.
 
                 JSValueType callerType = callerObs->getKnownTypeTag();
-                if (callerType == JSVAL_TYPE_DOUBLE) {
-                    MInstruction *bailType = MToInt32::New(ins);
-                    current->add(bailType);
-                    ins = bailType;
-                } else {
+                if (callerType != JSVAL_TYPE_DOUBLE && ins->type() != MIRType_Double) {
                     // We expect either an Int or a Value, this variant is not
                     // optimized and favor the int variant by filtering out all
                     // other inputs.
                     JS_ASSERT(callerType == JSVAL_TYPE_UNKNOWN);
+                    JS_ASSERT(ins->type() == MIRType_Value);
                     // Bail if the input is not a number.
                     MInstruction *toDouble = MUnbox::New(ins, MIRType_Double, MUnbox::Fallible);
-                    // Bail if the double does not fit in an int.
-                    MInstruction *toInt = MToInt32::New(ins);
                     current->add(toDouble);
-                    current->add(toInt);
-                    ins = toInt;
+                    ins = toDouble;
                 }
+                JS_ASSERT(ins->type() == MIRType_Double ||
+                          ins->type() == MIRType_Value);
+                // Bail if the double does not fit in an int.
+                MInstruction *toInt = MToInt32::New(ins);
+                current->add(toInt);
+                ins = toInt;
 
                 needsBarrier = false;
                 break;

js/src/jit-test/tests/ion/bug862100.js

@@ -0,0 +1,14 @@
+
+function TestCase(n, d, e, a) {}
+function reportCompare (expected, actual, description) {
+  new TestCase("", description, expected, actual);
+}
+new TestCase( "", "", 0, Number(new Number()) );
+reportCompare(true, true);
+evaluate("\
+function TestCase(n, d, e, a) {}\
+test_negation(-2147483648, 2147483648);\
+test_negation(2147483647, -2147483647);\
+function test_negation(value, expected)\
+    reportCompare(expected, '', '-(' + value + ') == ' + expected);\
+");