diff --git a/js/src/jit-test/tests/ion/bug919118.js b/js/src/jit-test/tests/ion/bug919118.js new file mode 100644 index 000000000000..31491292dbf3 --- /dev/null +++ b/js/src/jit-test/tests/ion/bug919118.js @@ -0,0 +1,13 @@ +setJitCompilerOption("ion.usecount.trigger", 50); + +var f32 = new Float32Array(1); +f32[0] = 13; +var str = "CAN HAS cheezburger? OKTHXBYE"; +var c; + +function f() { + c = str[ f32[0] ]; +} + +for(var n = 100; n; --n) f(); +print (c); diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h index ea6a0f5d16b3..858c425db5f3 100644 --- a/js/src/jit/MIR.h +++ b/js/src/jit/MIR.h @@ -2849,7 +2849,9 @@ class MAsmJSUnsignedToDouble // Converts a primitive (either typed or untyped) to an int32. If the input is // not primitive at runtime, a bailout occurs. If the input cannot be converted // to an int32 without loss (i.e. "5.5" or undefined) then a bailout occurs. -class MToInt32 : public MUnaryInstruction +class MToInt32 + : public MUnaryInstruction, + public NoFloatPolicy<0> { bool canBeNegativeZero_; @@ -2888,6 +2890,10 @@ class MToInt32 : public MUnaryInstruction return AliasSet::None(); } void computeRange(); + + TypePolicy *typePolicy() { + return this; + } }; // Converts a value or typed input to a truncated int32, for use with bitwise