Bug 1279898: IonMonkey - Don't run TI alias analysis on typed objects/arrays, r=jandem

js/src/jit-test/tests/ion/bug1279898.js

@@ -0,0 +1,19 @@
+
+function f() {
+    var i32 = new Int32Array(1);
+    var f32 = new Float32Array(i32.buffer);
+    for (var i = 0; i < 3; i++) {
+        var a0 = +1;
+        var a3 = +4;
+
+        i32[0] = a0;
+        var b0 = f32[0];
+
+        i32[0] = a3;
+        var b3 = f32[0];
+
+        assertEq(b0 != b3, true);
+    }
+}
+
+f();

js/src/jit/AliasAnalysisShared.cpp

@@ -47,13 +47,15 @@ static inline const MDefinition*
 MaybeUnwrap(const MDefinition* object)
 {
 
-    while (object->isSlots() || object->isElements() || object->isConvertElementsToDoubles() ||
-           object->isTypedArrayElements() || object->isTypedObjectElements())
-    {
+    while (object->isSlots() || object->isElements() || object->isConvertElementsToDoubles()) {
         MOZ_ASSERT(object->numOperands() == 1);
         object = object->getOperand(0);
     }
 
+    if (object->isTypedArrayElements())
+        return nullptr;
+    if (object->isTypedObjectElements())
+        return nullptr;
     if (object->isConstantElements())
         return nullptr;