Bug 1248503 - Fix initial heap assertion. r=nbp

Two MSimdBox instructions with the same SimdType must have identical template
objects, but they do not need to have identical initial heaps. One could
represent a pre-tenured SIMD object allocation.

MozReview-Commit-ID: ITymizUKjlN

--HG--
extra : rebase_source : f130b356de408bbaeecf3ff1070266e0223d4aaa

js/src/jit-test/tests/SIMD/bug1248503.js

@@ -0,0 +1,13 @@
+function assertEqVec(v, w) {
+    [0].forEach(i => v, w);
+    function assertEqX4(...opts) {}
+}
+gczeal(1);
+function f() {
+    SIMD.Float32x4();
+    var i1 = SIMD.Int32x4();
+    for (j = 0; j < 100000; ++j, eval.eval)
+        assertEqVec(SIMD.Int32x4.check(i1), i1);
+}
+f();
+

js/src/jit/MIR.h

@@ -3481,7 +3481,9 @@ class MSimdBox
         const MSimdBox* box = ins->toSimdBox();
         if (box->simdType() != simdType())
             return false;
-        MOZ_ASSERT(box->initialHeap() == initialHeap());
+        MOZ_ASSERT(box->templateObject() == templateObject());
+        if (box->initialHeap() != initialHeap())
+            return false;
         return true;
     }