Bug 1204604: Check for int32 value, not int32 type, in SIMD.T.{replaceLane,shuffle,swizzle}; r=lth

--HG--
extra : commitid : 7MmgnJUuUwi
extra : rebase_source : d69d9d84fe3904972d5f3ddbbaf7d684bfd0b321

js/src/builtin/SIMD.cpp

@@ -780,9 +780,9 @@ ReplaceLane(JSContext* cx, unsigned argc, Value* vp)
     Elem* vec = TypedObjectMemory<Elem*>(args[0]);
     Elem result[V::lanes];
 
-    if (!args[1].isInt32())
+    int32_t lanearg;
+    if (!args[1].isNumber() || !NumberIsInt32(args[1].toNumber(), &lanearg))
         return ErrorBadArgs(cx);
-    int32_t lanearg = args[1].toInt32();
     if (lanearg < 0 || uint32_t(lanearg) >= V::lanes)
         return ErrorBadArgs(cx);
     uint32_t lane = uint32_t(lanearg);
@@ -808,9 +808,9 @@ Swizzle(JSContext* cx, unsigned argc, Value* vp)
 
     uint32_t lanes[V::lanes];
     for (unsigned i = 0; i < V::lanes; i++) {
-        if (!args[i + 1].isInt32())
+        int32_t lane;
+        if (!args[i + 1].isNumber() || !NumberIsInt32(args[i + 1].toNumber(), &lane))
             return ErrorBadArgs(cx);
-        int32_t lane = args[i + 1].toInt32();
         if (lane < 0 || uint32_t(lane) >= V::lanes)
             return ErrorBadArgs(cx);
         lanes[i] = uint32_t(lane);
@@ -837,9 +837,9 @@ Shuffle(JSContext* cx, unsigned argc, Value* vp)
 
     uint32_t lanes[V::lanes];
     for (unsigned i = 0; i < V::lanes; i++) {
-        if (!args[i + 2].isInt32())
+        int32_t lane;
+        if (!args[i + 2].isNumber() || !NumberIsInt32(args[i + 2].toNumber(), &lane))
             return ErrorBadArgs(cx);
-        int32_t lane = args[i + 2].toInt32();
         if (lane < 0 || uint32_t(lane) >= (2 * V::lanes))
             return ErrorBadArgs(cx);
         lanes[i] = uint32_t(lane);

js/src/jit-test/tests/SIMD/swizzle.js

@@ -84,3 +84,19 @@ try {
 } catch(e) {
     assertEq(e instanceof TypeError, true);
 }
+
+(function() {
+    var zappa = 0;
+
+    function testBailouts() {
+        var i4 = SIMD.Int32x4(1, 2, 3, 4);
+        for (var i = 0; i < 300; i++) {
+            var value = i == 299 ? 2.5 : 1;
+            SIMD.Int32x4.swizzle(i4, value, 3, 2, 0);
+            zappa = i;
+        }
+    }
+
+    try { testBailouts(); } catch (e) {}
+    assertEq(zappa, 298);
+})();

js/src/jit/MIR.h

@@ -1853,6 +1853,7 @@ class MSimdGeneralShuffle :
 
         setResultType(type);
         specialization_ = type;
+        setGuard(); // throws if lane index is out of bounds
         setMovable();
     }