Fixed register allocation bug in left-shift operations (bug 606063, r=dmandelin).

js/src/methodjit/FastOps.cpp

@@ -524,13 +524,21 @@ mjit::Compiler::jsop_bitop(JSOp op)
         RegisterID rr = frame.tempRegForData(rhs);
 #endif
 
-        if (lhs->isConstant()) {
-            frame.pinReg(rr);
+        if (frame.haveSameBacking(lhs, rhs)) {
+            // It's okay to allocReg(). If |rr| is evicted, it won't result in
+            // a load, and |rr == reg| is fine since this is (x << x).
             reg = frame.allocReg();
-            masm.move(Imm32(lhs->getValue().toInt32()), reg);
-            frame.unpinReg(rr);
+            if (rr != reg)
+                masm.move(rr, reg);
         } else {
-            reg = frame.copyDataIntoReg(lhs);
+            frame.pinReg(rr);
+            if (lhs->isConstant()) {
+                reg = frame.allocReg();
+                masm.move(Imm32(lhs->getValue().toInt32()), reg);
+            } else {
+                reg = frame.copyDataIntoReg(lhs);
+            }
+            frame.unpinReg(rr);
         }
         
         if (op == JSOP_LSH) {

js/src/trace-test/tests/jaeger/testShiftSameBacking.js

@@ -0,0 +1,12 @@
+// vim: set ts=4 sw=4 tw=99 et:
+
+function f(a) {
+    var x = a;
+    var y = x;
+
+    assertEq((x << y), (a << a));
+    assertEq((y << x), (a << a));
+}
+
+f(2);
+