From a29af12056f2f725a4fd8036041ee0b89f439637 Mon Sep 17 00:00:00 2001
From: Jeff Hemphill <jthemphill@gmail.com>
Date: Wed, 8 Nov 2017 15:42:57 +0000
Subject: [PATCH] Bug 1104647 - IonMonkey: Implement MathFunction(Floor)
 recover instruction r=nbp

---
 .../tests/ion/rinstructions-no-sse4.js        | 37 +++++++++++++++++++
 js/src/jit/MIR.h                              |  1 +
 js/src/jit/Recover.cpp                        |  3 ++
 3 files changed, 41 insertions(+)
 create mode 100644 js/src/jit-test/tests/ion/rinstructions-no-sse4.js

diff --git a/js/src/jit-test/tests/ion/rinstructions-no-sse4.js b/js/src/jit-test/tests/ion/rinstructions-no-sse4.js
new file mode 100644
index 000000000000..7cc483dbd033
--- /dev/null
+++ b/js/src/jit-test/tests/ion/rinstructions-no-sse4.js
@@ -0,0 +1,37 @@
+// |jit-test| --no-sse4;
+
+// This test is a fork of dce-with-rinstructions.js. It tests recover
+// instructions which are only executed on pre-SSE4 processors.
+
+setJitCompilerOption("baseline.warmup.trigger", 10);
+setJitCompilerOption("ion.warmup.trigger", 20);
+
+const max = 200;
+
+// Check that we are able to remove the operation inside recover test
+// functions (denoted by "rop..."), when we inline the first version
+// of uceFault, and ensure that the bailout is correct when uceFault
+// is replaced (which cause an invalidation bailout)
+let uceFault = function (i) {
+    if (i > 98)
+        uceFault = function (i) { return true; };
+    return false;
+};
+
+let uceFault_floor_double = eval(
+    uneval(uceFault)
+        .replace('uceFault', 'uceFault_floor_double')
+);
+function rfloor_double(i) {
+    const x = Math.floor(i + (-1 >>> 0));
+    if (uceFault_floor_double(i) || uceFault_floor_double(i))
+        assertEq(x, 99 + (-1 >>> 0)); /* = i + 2 ^ 32 - 1 */
+    assertRecoveredOnBailout(x, true);
+    return i;
+}
+
+for (let j = 100 - max; j < 100; j++) {
+    with({}){} // Do not Ion-compile this loop.
+    const i = j < 2 ? (Math.abs(j) % 50) + 2 : j;
+    rfloor_double(i);
+}
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index bb7e79bb737f..1d346d5041c9 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -7017,6 +7017,7 @@ class MMathFunction
         switch(function_) {
           case Sin:
           case Log:
+          case Floor:
           case Round:
             return true;
           default:
diff --git a/js/src/jit/Recover.cpp b/js/src/jit/Recover.cpp
index 342f72ac7468..c87348202c35 100644
--- a/js/src/jit/Recover.cpp
+++ b/js/src/jit/Recover.cpp
@@ -962,6 +962,9 @@ MMathFunction::writeRecoverData(CompactBufferWriter& writer) const
 {
     MOZ_ASSERT(canRecoverOnBailout());
     switch (function_) {
+      case Floor:
+        writer.writeUnsigned(uint32_t(RInstruction::Recover_Floor));
+        return true;
       case Round:
         writer.writeUnsigned(uint32_t(RInstruction::Recover_Round));
         return true;