From 3bd0bd475d3411c3cbc0ec21651bb33390fa49a7 Mon Sep 17 00:00:00 2001
From: "Nicolas B. Pierron" <nicolas.b.pierron@mozilla.com>
Date: Mon, 25 Feb 2013 15:34:31 -0800
Subject: [PATCH] Bug 844059 - Prevent int-specialized GetElementIC to produce
 stub for float typed arrays. r=dvander

---
 js/src/ion/IonCaches.cpp               | 19 +++++++++++++++----
 js/src/jit-test/tests/ion/bug844059.js | 12 ++++++++++++
 2 files changed, 27 insertions(+), 4 deletions(-)
 create mode 100644 js/src/jit-test/tests/ion/bug844059.js

diff --git a/js/src/ion/IonCaches.cpp b/js/src/ion/IonCaches.cpp
index 1b678950054a..5d632a3e4d75 100644
--- a/js/src/ion/IonCaches.cpp
+++ b/js/src/ion/IonCaches.cpp
@@ -1618,7 +1618,13 @@ GetElementIC::attachTypedArrayElement(JSContext *cx, IonScript *ion, JSObject *o
     MacroAssembler masm;
 
     // The array type is the object within the table of typed array classes.
-    int arrayType = obj->getClass() - &TypedArray::classes[0];
+    int arrayType = TypedArray::type(obj);
+
+    // The output register is not yet specialized as a float register, the only
+    // way to accept float typed arrays for now is to return a Value type.
+    bool floatOutput = arrayType == TypedArray::TYPE_FLOAT32 ||
+                       arrayType == TypedArray::TYPE_FLOAT64;
+    JS_ASSERT_IF(!output().hasValue(), !floatOutput);
 
     Register tmpReg = output().scratchReg().gpr();
     JS_ASSERT(tmpReg != InvalidReg);
@@ -1723,9 +1729,14 @@ GetElementIC::update(JSContext *cx, size_t cacheIndex, HandleObject obj,
                 return false;
             attachedStub = true;
         } else if (obj->isTypedArray() && idval.isInt32()) {
-            if (!cache.attachTypedArrayElement(cx, ion, obj, idval))
-                return false;
-            attachedStub = true;
+            int arrayType = TypedArray::type(obj);
+            bool floatOutput = arrayType == TypedArray::TYPE_FLOAT32 ||
+                               arrayType == TypedArray::TYPE_FLOAT64;
+            if (!floatOutput || cache.output().hasValue()) {
+                if (!cache.attachTypedArrayElement(cx, ion, obj, idval))
+                    return false;
+                attachedStub = true;
+            }
         }
     }
 
diff --git a/js/src/jit-test/tests/ion/bug844059.js b/js/src/jit-test/tests/ion/bug844059.js
new file mode 100644
index 000000000000..d4bbe5c66414
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug844059.js
@@ -0,0 +1,12 @@
+
+function assertArraysFirstEqual(a, b) {
+    assertEq(a[0], b[0]);
+}
+
+function check(b) {
+    var a = deserialize(serialize(b));
+    assertArraysFirstEqual(a, b);
+}
+
+check(new Int8Array(1));
+check(new Float64Array(1));