Bug 462060 - TM: JIT: Initializing an array to a constant in a loop doesn't work for some constant values. r=brendan

js/src/jsbuiltins.cpp

@@ -105,7 +105,7 @@ jsval FASTCALL
 js_BoxDouble(JSContext* cx, jsdouble d)
 {
     int32 i;
-    if (JSDOUBLE_IS_INT(d, i))
+    if (JSDOUBLE_IS_INT(d, i) && INT_FITS_IN_JSVAL(i))
         return INT_TO_JSVAL(i);
     JS_ASSERT(JS_ON_TRACE(cx));
     jsval v; /* not rooted but ok here because we know GC won't run */

js/src/trace-test.js

@@ -2380,6 +2380,18 @@ function bug464403() {
 bug464403.expected = "ok";
 test(bug464403);
 
+function testBoxDoubleWithDoubleSizedInt()
+{
+  var i = 0;
+  var a = new Array(3);
+
+  while (i < a.length)
+    a[i++] = 0x5a827999;
+  return a.join(",");
+}
+testBoxDoubleWithDoubleSizedInt.expected = "1518500249,1518500249,1518500249";
+test(testBoxDoubleWithDoubleSizedInt);
+
 /* NOTE: Keep this test last, since it screws up all for...in loops after it. */
 function testGlobalProtoAccess() {
     return "ok";