Bug 639343 - Slight adjustment to how typed-array properties are handled in the tracer. r=dvander

js/src/jit-test/tests/basic/typed-array-getprop-out-of-range.js

@@ -0,0 +1,11 @@
+var r = Object.prototype[0] = /a/;
+
+function test()
+{
+  for (var i = 0, sz = RUNLOOP; i < sz; i++)
+  {
+    var ta = new Int8Array();
+    assertEq(ta[0], r);
+  }
+}
+test();

js/src/jstracer.cpp

@@ -14346,15 +14346,9 @@ TraceRecorder::typedArrayElement(Value& oval, Value& ival, Value*& vp, LIns*& v_
     /* priv_ins will load the TypedArray* */
     LIns* priv_ins = w.ldpObjPrivate(obj_ins);
 
-    /* for out-of-range, do the same thing that the interpreter does, which is return undefined */
-    if ((jsuint) idx >= tarray->length) {
-        CHECK_STATUS_A(guard(false,
-                             w.ltui(idx_ins, w.ldiConstTypedArrayLength(priv_ins)),
-                             BRANCH_EXIT,
-                             /* abortIfAlwaysExits = */true));
-        v_ins = w.immiUndefined();
-        return ARECORD_CONTINUE;
-    }
+    /* Abort if out-of-range. */
+    if ((jsuint) idx >= tarray->length)
+        RETURN_STOP_A("out-of-range index on typed array");
 
     /*
      * Ensure idx < length

js/src/methodjit/PolyIC.cpp

@@ -2268,12 +2268,7 @@ GetElementIC::attachTypedArray(JSContext *cx, JSObject *obj, const Value &v, jsi
         LoadFromTypedArray(masm, tarray, addr, typeReg, objReg);
     }
 
-    Jump done1 = masm.jump();
-
-    outOfBounds.linkTo(masm.label(), &masm);
-    masm.loadValueAsComponents(UndefinedValue(), typeReg, objReg);
-
-    Jump done2 = masm.jump();
+    Jump done = masm.jump();
 
     PICLinker buffer(masm, *this);
     if (!buffer.init(cx))
@@ -2283,8 +2278,8 @@ GetElementIC::attachTypedArray(JSContext *cx, JSObject *obj, const Value &v, jsi
         return disable(cx, "code memory is out of range");
 
     buffer.link(claspGuard, slowPathStart);
-    buffer.link(done1, fastPathRejoin);
-    buffer.link(done2, fastPathRejoin);
+    buffer.link(outOfBounds, slowPathStart);
+    buffer.link(done, fastPathRejoin);
 
     CodeLocationLabel cs = buffer.finalizeCodeAddendum();
     JaegerSpew(JSpew_PICs, "generated getelem typed array stub at %p\n", cs.executableAddress());