Bug 1310418 - Fix Assertion failure: this->is<MIRType>(), at js/src/jit/MIR.h:891 r=nbp

js/src/jit-test/tests/basic/bug1310418.js

@@ -0,0 +1,9 @@
+(function(stdlib, n, heap) {
+    "use asm";
+    var Uint8ArrayView = new stdlib.Uint8Array(heap);
+    function f(d1) {
+        d1 = +d1;
+        var d2 = .0;
+        Uint8ArrayView[d1 < d2] = 0 + 3 + (d2 > -0);
+    }
+})(this, 0>>0, new Int32Array(0))

js/src/jit/FoldLinearArithConstants.cpp

@@ -52,13 +52,16 @@ AnalyzeAdd(TempAllocator& alloc, MAdd* add)
     if (sum.constant == 0 || !sum.term)
         return;
 
-    // Do not replace an add where the outcome is the same add instruction.
+    // Determine which operand is the constant.
     int idx = add->getOperand(0)->isConstant() ? 0 : 1 ;
-    MOZ_ASSERT(add->getOperand(idx)->toConstant()->type() == MIRType::Int32);
-    if (sum.term == add->getOperand(1 - idx) ||
-        sum.constant == add->getOperand(idx)->toConstant()->toInt32())
-    {
-        return;
+    if (add->getOperand(idx)->isConstant()) {
+        // Do not replace an add where the outcome is the same add instruction.
+        MOZ_ASSERT(add->getOperand(idx)->toConstant()->type() == MIRType::Int32);
+        if (sum.term == add->getOperand(1 - idx) ||
+            sum.constant == add->getOperand(idx)->toConstant()->toInt32())
+        {
+            return;
+        }
     }
 
     MInstruction* rhs = MConstant::New(alloc, Int32Value(sum.constant));