From d23a2114cfd8038439fc9791db46f2fe62bbdd04 Mon Sep 17 00:00:00 2001
From: Benjamin Bouvier <benj@benj.me>
Date: Thu, 12 Feb 2015 15:49:33 +0100
Subject: [PATCH] Bug 1130845: Add a list of SIMD freed stack slots in
 LinearScan; r=sunfish

--HG--
extra : rebase_source : 7828fb3896a090d03249a8d00c0a599196a949fc
---
 js/src/jit-test/tests/SIMD/bug1130845.js | 12 ++++++++++++
 js/src/jit/LinearScan.cpp                |  8 ++++++--
 js/src/jit/LinearScan.h                  |  1 +
 3 files changed, 19 insertions(+), 2 deletions(-)
 create mode 100644 js/src/jit-test/tests/SIMD/bug1130845.js

diff --git a/js/src/jit-test/tests/SIMD/bug1130845.js b/js/src/jit-test/tests/SIMD/bug1130845.js
new file mode 100644
index 000000000000..7b349af19e92
--- /dev/null
+++ b/js/src/jit-test/tests/SIMD/bug1130845.js
@@ -0,0 +1,12 @@
+var int32x4 = SIMD.int32x4;
+function test() {
+  var a = int32x4();
+  var b = int32x4(10, 20, 30, 40);
+  var c = SIMD.int32x4.and(a, b);
+  assertEq(c.x, 0);
+  return 0;
+}
+test();
+var u = [], v = [];
+for (var j=0; j<u.length; ++j)
+    v[test()] = t;
diff --git a/js/src/jit/LinearScan.cpp b/js/src/jit/LinearScan.cpp
index a125eded6c66..92fe761ea4ef 100644
--- a/js/src/jit/LinearScan.cpp
+++ b/js/src/jit/LinearScan.cpp
@@ -823,7 +823,9 @@ LinearScanAllocator::allocateSlotFor(const LiveInterval *interval)
     LinearScanVirtualRegister *reg = &vregs[interval->vreg()];
 
     SlotList *freed;
-    if (reg->type() == LDefinition::DOUBLE)
+    if (reg->def()->isSimdType())
+        freed = &finishedQuadSlots_;
+    else if (reg->type() == LDefinition::DOUBLE)
         freed = &finishedDoubleSlots_;
 #if JS_BITS_PER_WORD == 64
     else if (reg->type() == LDefinition::GENERAL ||
@@ -916,7 +918,9 @@ LinearScanAllocator::freeAllocation(LiveInterval *interval, LAllocation *alloc)
     LinearScanVirtualRegister *mine = &vregs[interval->vreg()];
     if (!IsNunbox(mine)) {
         if (alloc->isStackSlot()) {
-            if (mine->type() == LDefinition::DOUBLE)
+            if (mine->def()->isSimdType())
+                finishedQuadSlots_.append(interval);
+            else if (mine->type() == LDefinition::DOUBLE)
                 finishedDoubleSlots_.append(interval);
 #if JS_BITS_PER_WORD == 64
             else if (mine->type() == LDefinition::GENERAL ||
diff --git a/js/src/jit/LinearScan.h b/js/src/jit/LinearScan.h
index 2e0a940098c8..592aea22361f 100644
--- a/js/src/jit/LinearScan.h
+++ b/js/src/jit/LinearScan.h
@@ -81,6 +81,7 @@ class LinearScanAllocator
     typedef Vector<LiveInterval *, 0, SystemAllocPolicy> SlotList;
     SlotList finishedSlots_;
     SlotList finishedDoubleSlots_;
+    SlotList finishedQuadSlots_;
 #ifdef JS_NUNBOX32
     SlotList finishedNunboxSlots_;
 #endif