Bug 1151323 - Handle loading unboxed int32 properties into floating point registers, r=jandem.

js/src/jit-test/tests/ion/bug1151323.js

@@ -0,0 +1,8 @@
+
+function map_test(cases) {
+    for (var i = 0; i < cases.length; i++) {
+        var expected = cases[i].expected;
+    }
+}
+map_test([{ input: 8, expected: 1114369}, { input: -1, expected: 0}]);
+map_test([{ expected: 16777215}, { expected: 4294967241 }]);

js/src/jit/MacroAssembler.cpp

@@ -798,8 +798,16 @@ void
 MacroAssembler::loadUnboxedProperty(T address, JSValueType type, TypedOrValueRegister output)
 {
     switch (type) {
+      case JSVAL_TYPE_INT32: {
+          // Handle loading an int32 into a double reg.
+          if (output.type() == MIRType_Double) {
+              convertInt32ToDouble(address, output.typedReg().fpu());
+              break;
+          }
+          // Fallthrough.
+      }
+
       case JSVAL_TYPE_BOOLEAN:
-      case JSVAL_TYPE_INT32:
       case JSVAL_TYPE_STRING: {
         Register outReg;
         if (output.hasValue()) {

js/src/jit/arm/MacroAssembler-arm.cpp

@@ -61,6 +61,21 @@ MacroAssemblerARM::convertInt32ToDouble(const Address& src, FloatRegister dest)
     as_vcvt(dest, VFPRegister(ScratchDoubleReg).sintOverlay());
 }
 
+void
+MacroAssemblerARM::convertInt32ToDouble(const BaseIndex& src, FloatRegister dest)
+{
+    Register base = src.base;
+    uint32_t scale = Imm32::ShiftOf(src.scale).value;
+
+    if (src.offset != 0) {
+        ma_mov(base, ScratchRegister);
+        base = ScratchRegister;
+        ma_add(Imm32(src.offset), base);
+    }
+    ma_ldr(DTRAddr(base, DtrRegImmShift(src.index, LSL, scale)), ScratchRegister);
+    convertInt32ToDouble(ScratchRegister, dest);
+}
+
 void
 MacroAssemblerARM::convertUInt32ToDouble(Register src, FloatRegister dest_)
 {

js/src/jit/arm/MacroAssembler-arm.h

@@ -68,6 +68,7 @@ class MacroAssemblerARM : public Assembler
     void convertBoolToInt32(Register source, Register dest);
     void convertInt32ToDouble(Register src, FloatRegister dest);
     void convertInt32ToDouble(const Address& src, FloatRegister dest);
+    void convertInt32ToDouble(const BaseIndex& src, FloatRegister dest);
     void convertUInt32ToFloat32(Register src, FloatRegister dest);
     void convertUInt32ToDouble(Register src, FloatRegister dest);
     void convertDoubleToFloat32(FloatRegister src, FloatRegister dest,

js/src/jit/x86-shared/MacroAssembler-x86-shared.h

@@ -683,6 +683,9 @@ class MacroAssemblerX86Shared : public Assembler
     void convertInt32ToDouble(const Address& src, FloatRegister dest) {
         convertInt32ToDouble(Operand(src), dest);
     }
+    void convertInt32ToDouble(const BaseIndex& src, FloatRegister dest) {
+        convertInt32ToDouble(Operand(src), dest);
+    }
     void convertInt32ToDouble(const Operand& src, FloatRegister dest) {
         // Clear the output register first to break dependencies; see above;
         zeroDouble(dest);