From a5e003cc23b46d2b1bb5af7b1ed467719c969bf2 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Fri, 26 Jul 2013 11:29:48 -0600
Subject: [PATCH] Bug 898021 - Mark values written to integer typed arrays as
 truncated, r=jandem.

---
 js/src/ion/MIR.h             |  8 ++++++++
 js/src/ion/RangeAnalysis.cpp | 18 ++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/js/src/ion/MIR.h b/js/src/ion/MIR.h
index 464e7b2496cc..58896a8d1dd2 100644
--- a/js/src/ion/MIR.h
+++ b/js/src/ion/MIR.h
@@ -5233,6 +5233,7 @@ class MStoreTypedArrayElement
     void setRacy() {
         racy_ = true;
     }
+    bool isOperandTruncated(size_t index) const;
 };
 
 class MStoreTypedArrayElementHole
@@ -5295,6 +5296,7 @@ class MStoreTypedArrayElementHole
     AliasSet getAliasSet() const {
         return AliasSet::Store(AliasSet::TypedArrayElement);
     }
+    bool isOperandTruncated(size_t index) const;
 };
 
 // Store a value infallibly to a statically known typed array.
@@ -5322,6 +5324,11 @@ class MStoreTypedArrayElementStatic :
     }
 
     ArrayBufferView::ViewType viewType() const { return JS_GetArrayBufferViewType(typedArray_); }
+    bool isFloatArray() const {
+        return (viewType() == TypedArrayObject::TYPE_FLOAT32 ||
+                viewType() == TypedArrayObject::TYPE_FLOAT64);
+    }
+
     void *base() const;
     size_t length() const;
 
@@ -5330,6 +5337,7 @@ class MStoreTypedArrayElementStatic :
     AliasSet getAliasSet() const {
         return AliasSet::Store(AliasSet::TypedArrayElement);
     }
+    bool isOperandTruncated(size_t index) const;
 };
 
 // Compute an "effective address", i.e., a compound computation of the form:
diff --git a/js/src/ion/RangeAnalysis.cpp b/js/src/ion/RangeAnalysis.cpp
index 0489857cbfe0..ed5bad388666 100644
--- a/js/src/ion/RangeAnalysis.cpp
+++ b/js/src/ion/RangeAnalysis.cpp
@@ -1824,6 +1824,24 @@ MToDouble::isOperandTruncated(size_t index) const
     return type() == MIRType_Int32;
 }
 
+bool
+MStoreTypedArrayElement::isOperandTruncated(size_t index) const
+{
+    return index == 2 && !isFloatArray();
+}
+
+bool
+MStoreTypedArrayElementHole::isOperandTruncated(size_t index) const
+{
+    return index == 3 && !isFloatArray();
+}
+
+bool
+MStoreTypedArrayElementStatic::isOperandTruncated(size_t index) const
+{
+    return index == 1 && !isFloatArray();
+}
+
 // Ensure that all observables uses can work with a truncated
 // version of the |candidate|'s result.
 static bool