Bug 919958 - Ionmonkey: correct instruction numbering in alias analysis and re-enable heap load movement

js/src/jit/AliasAnalysis.cpp

@@ -198,6 +198,9 @@ AliasAnalysis::analyze()
             }
         }
 
+        // Renumber the last instruction, as the analysis depends on this and the order.
+        block->lastIns()->setId(newId++);
+
         if (block->isLoopBackedge()) {
             JS_ASSERT(loop_->loopHeader() == block->loopHeaderOfBackedge());
             IonSpew(IonSpew_Alias, "Processing loop backedge %d (header %d)", block->id(),

js/src/jit/EdgeCaseAnalysis.cpp

@@ -30,6 +30,7 @@ EdgeCaseAnalysis::analyzeLate()
             iter->setId(nextId++);
             iter->analyzeEdgeCasesForward();
         }
+        block->lastIns()->setId(nextId++);
     }
 
     for (PostorderIterator block(graph.poBegin()); block != graph.poEnd(); block++) {

js/src/jit/MIR.h

@@ -8747,8 +8747,7 @@ class MAsmJSLoadHeap : public MUnaryInstruction, public MAsmJSHeapAccess
     MAsmJSLoadHeap(ArrayBufferView::ViewType vt, MDefinition *ptr)
       : MUnaryInstruction(ptr), MAsmJSHeapAccess(vt, false)
     {
-        // Disabled due to errors, see bug 919958
-        // setMovable();
+        setMovable();
         if (vt == ArrayBufferView::TYPE_FLOAT32 || vt == ArrayBufferView::TYPE_FLOAT64)
             setResultType(MIRType_Double);
         else