diff --git a/lib/Backend/GlobOpt.cpp b/lib/Backend/GlobOpt.cpp index f634c6b53b5..80ec4dad683 100644 --- a/lib/Backend/GlobOpt.cpp +++ b/lib/Backend/GlobOpt.cpp @@ -7072,6 +7072,18 @@ GlobOpt::OptConstFoldUnary( this->ToFloat64Dst(instr, dst->AsRegOpnd(), this->currentBlock); } } + + // If this is an induction variable, then treat it the way the prepass would have if it had seen + // the assignment and the resulting change to the value number, and mark it as indeterminate. + for (Loop * loop = this->currentBlock->loop; loop; loop = loop->parent) + { + InductionVariable *iv = nullptr; + if (loop->inductionVariables && loop->inductionVariables->TryGetReference(dstSym->m_id, &iv)) + { + iv->SetChangeIsIndeterminate(); + } + } + return true; } @@ -12391,6 +12403,17 @@ GlobOpt::OptConstFoldBinary( this->ToInt32Dst(instr, dst->AsRegOpnd(), this->currentBlock); } + // If this is an induction variable, then treat it the way the prepass would have if it had seen + // the assignment and the resulting change to the value number, and mark it as indeterminate. + for (Loop * loop = this->currentBlock->loop; loop; loop = loop->parent) + { + InductionVariable *iv = nullptr; + if (loop->inductionVariables && loop->inductionVariables->TryGetReference(dstSym->m_id, &iv)) + { + iv->SetChangeIsIndeterminate(); + } + } + return true; } diff --git a/test/Optimizer/bug42111.js b/test/Optimizer/bug42111.js new file mode 100644 index 00000000000..b2cd33402c0 --- /dev/null +++ b/test/Optimizer/bug42111.js @@ -0,0 +1,23 @@ +function opt(arr, start, end) { + for (let i = start; i < end; i++) { + if (i === 10) { + i += 0; + } + arr[i] = 2.3023e-320; + } +} + +let arr = new Array(100); + +function main() { + arr.fill(1.1); + + for (let i = 0; i < 1000; i++) + opt(arr, 0, 3); + + opt(arr, 0, 100000); +} + +main(); + +WScript.Echo(arr[0] === 2.3023e-320 ? 'pass' : 'fail'); diff --git a/test/Optimizer/rlexe.xml b/test/Optimizer/rlexe.xml index 9ceaaeecaae..495aa3ddabd 100644 --- a/test/Optimizer/rlexe.xml +++ b/test/Optimizer/rlexe.xml @@ -10,6 +10,11 @@ bug41530.js + + + bug42111.js + + bug70.js