Fix constant folding bug in Uint8Clamped arrays (bug 624483, r=vlad).

js/src/jit-test/tests/jaeger/bug624483.js

@@ -0,0 +1,5 @@
+var arr = new Uint8ClampedArray(16);
+for (var i = 0; i < 16; i++) {
+    arr[i] = "Infinity";
+}
+assertEq(arr[14], 255);

js/src/methodjit/TypedArrayIC.h

@@ -178,34 +178,30 @@ ConstantFoldForIntArray(JSContext *cx, js::TypedArray *tarray, ValueRemat *vr)
     if (!vr->isConstant())
         return true;
 
-    if (vr->knownType() == JSVAL_TYPE_INT32) {
-        if (tarray->type == js::TypedArray::TYPE_UINT8_CLAMPED)
-            *vr = ValueRemat::FromConstant(Int32Value(ClampIntForUint8Array(vr->value().toInt32())));
-        return true;
-    }
-
+    // Convert from string to double first (see bug 624483).
     Value v = vr->value();
-    if (v.isDouble()) {
-        int32 i32 = tarray->type == js::TypedArray::TYPE_UINT8_CLAMPED
-                    ? js_TypedArray_uint8_clamp_double(v.toDouble())
-                    : js_DoubleToECMAInt32(v.toDouble());
-        *vr = ValueRemat::FromConstant(Int32Value(i32));
-        return true;
+    if (v.isString()) {
+        double d;
+        if (!StringToNumberType<double>(cx, v.toString(), &d))
+            return false;
+        v.setNumber(d);
     }
 
     int32 i32 = 0;
-    if (v.isString()) {
-        if (!StringToNumberType<int32>(cx, v.toString(), &i32))
-            return false;
+    if (v.isDouble()) {
+        i32 = (tarray->type == js::TypedArray::TYPE_UINT8_CLAMPED)
+              ? js_TypedArray_uint8_clamp_double(v.toDouble())
+              : js_DoubleToECMAInt32(v.toDouble());
+    } else if (v.isInt32()) {
+        i32 = v.toInt32();
+        if (tarray->type == js::TypedArray::TYPE_UINT8_CLAMPED)
+            i32 = ClampIntForUint8Array(i32);
     } else if (v.isBoolean()) {
         i32 = v.toBoolean() ? 1 : 0;
     } else {
         JS_NOT_REACHED("unknown constant type");
     }
 
-    if (tarray->type == js::TypedArray::TYPE_UINT8_CLAMPED)
-        i32 = ClampIntForUint8Array(i32);
-
     *vr = ValueRemat::FromConstant(Int32Value(i32));
 
     return true;