Bug 1236114 - IonMonkey: Move 'Sink' phase before the 'Remove Unnecessary Bitops' phase. r=sunfish

js/src/jit-test/tests/ion/recover-bug1236114.js

@@ -0,0 +1,5 @@
+function f(x) {
+    return (!(Math.round(Math.hypot(Number.MIN_VALUE, Math.fround(x))) | 0) | 0) !== (Math.atanh(x) ? false : Math.tan(0))
+}
+f(Number.MIN_VALUE)
+assertEq(f(4294967295), true)

js/src/jit/Ion.cpp

@@ -1651,9 +1651,9 @@ OptimizeMIR(MIRGenerator* mir)
         }
     }
 
+    RangeAnalysis r(mir, graph);
     if (mir->optimizationInfo().rangeAnalysisEnabled()) {
         AutoTraceLog log(logger, TraceLogger_RangeAnalysis);
-        RangeAnalysis r(mir, graph);
         if (!r.addBetaNodes())
             return false;
         gs.spewPass("Beta");
@@ -1720,6 +1720,28 @@ OptimizeMIR(MIRGenerator* mir)
         }
     }
 
+    {
+        AutoTraceLog log(logger, TraceLogger_Sink);
+        if (!Sink(mir, graph))
+            return false;
+        gs.spewPass("Sink");
+        AssertExtendedGraphCoherency(graph);
+
+        if (mir->shouldCancel("Sink"))
+            return false;
+    }
+
+    if (mir->optimizationInfo().rangeAnalysisEnabled()) {
+        AutoTraceLog log(logger, TraceLogger_RemoveUnnecessaryBitops);
+        if (!r.removeUnnecessaryBitops())
+            return false;
+        gs.spewPass("Remove Unnecessary Bitops");
+        AssertExtendedGraphCoherency(graph);
+
+        if (mir->shouldCancel("Remove Unnecessary Bitops"))
+            return false;
+    }
+
     if (mir->optimizationInfo().eaaEnabled()) {
         AutoTraceLog log(logger, TraceLogger_EffectiveAddressAnalysis);
         EffectiveAddressAnalysis eaa(mir, graph);
@@ -1753,17 +1775,6 @@ OptimizeMIR(MIRGenerator* mir)
             return false;
     }
 
-    {
-        AutoTraceLog log(logger, TraceLogger_EliminateDeadCode);
-        if (!Sink(mir, graph))
-            return false;
-        gs.spewPass("Sink");
-        AssertExtendedGraphCoherency(graph);
-
-        if (mir->shouldCancel("Sink"))
-            return false;
-    }
-
     if (mir->optimizationInfo().instructionReorderingEnabled()) {
         AutoTraceLog log(logger, TraceLogger_ReorderInstructions);
         if (!ReorderInstructions(mir, graph))

js/src/jit/RangeAnalysis.cpp

@@ -3059,7 +3059,6 @@ RangeAnalysis::truncate()
     MOZ_ASSERT(!mir->compilingAsmJS());
 
     Vector<MDefinition*, 16, SystemAllocPolicy> worklist;
-    Vector<MBinaryBitwiseInstruction*, 16, SystemAllocPolicy> bitops;
 
     for (PostorderIterator block(graph_.poBegin()); block != graph_.poEnd(); block++) {
         for (MInstructionReverseIterator iter(block->rbegin()); iter != block->rend(); iter++) {
@@ -3158,11 +3157,26 @@ RangeAnalysis::truncate()
         AdjustTruncatedInputs(alloc(), def);
     }
 
+    return true;
+}
+
+bool
+RangeAnalysis::removeUnnecessaryBitops()
+{
+    // Note: This operation change the semantic of the program in a way which
+    // uniquely works with Int32, Recover Instructions added by the Sink phase
+    // expects the MIR Graph to still have a valid flow as-if they were double
+    // operations instead of Int32 operations. Thus, this phase should be
+    // executed after the Sink phase, and before DCE.
+
     // Fold any unnecessary bitops in the graph, such as (x | 0) on an integer
     // input. This is done after range analysis rather than during GVN as the
     // presence of the bitop can change which instructions are truncated.
     for (size_t i = 0; i < bitops.length(); i++) {
         MBinaryBitwiseInstruction* ins = bitops[i];
+        if (ins->isRecoveredOnBailout())
+            continue;
+
         MDefinition* folded = ins->foldUnnecessaryBitop();
         if (folded != ins) {
             ins->replaceAllLiveUsesWith(folded);
@@ -3170,9 +3184,11 @@ RangeAnalysis::truncate()
         }
     }
 
+    bitops.clear();
     return true;
 }
 
+
 ///////////////////////////////////////////////////////////////////////////////
 // Collect Range information of operands
 ///////////////////////////////////////////////////////////////////////////////

js/src/jit/RangeAnalysis.h

@@ -95,6 +95,7 @@ class RangeAnalysis
   protected:
     MIRGenerator* mir;
     MIRGraph& graph_;
+    Vector<MBinaryBitwiseInstruction*, 16, SystemAllocPolicy> bitops;
 
     TempAllocator& alloc() const;
 
@@ -108,6 +109,7 @@ class RangeAnalysis
     bool prepareForUCE(bool* shouldRemoveDeadCode);
     bool tryRemovingGuards();
     bool truncate();
+    bool removeUnnecessaryBitops();
 
     // Any iteration bounds discovered for loops in the graph.
     LoopIterationBoundVector loopIterationBounds;

js/src/vm/TraceLoggingTypes.h

@@ -52,6 +52,8 @@
     _(Sincos)                                         \
     _(RangeAnalysis)                                  \
     _(LoopUnrolling)                                  \
+    _(Sink)                                           \
+    _(RemoveUnnecessaryBitops)                        \
     _(EffectiveAddressAnalysis)                       \
     _(AlignmentMaskAnalysis)                          \
     _(EliminateDeadCode)                              \