Bug 1266768 - Give MBoundsCheck an explicit type policy. r=lth

js/src/jit-test/tests/ion/bug1266768.js

@@ -0,0 +1,16 @@
+if (!this.SharedArrayBuffer)
+    quit();
+
+function mod(stdlib) {
+    add = stdlib.Atomics.add;
+    function f3() {
+        add(i8a, 0 | 0 && this && BUGNUMBER, 0);
+    }
+    return {f3: f3, 0: 0};
+}
+i8a = new Int8Array(new SharedArrayBuffer(1));
+var {
+    f3
+} = mod(this, {})
+for (i = 0; i < 1000; i++)
+    f3();

js/src/jit/Lowering.cpp

@@ -2933,8 +2933,12 @@ LIRGenerator::visitNot(MNot* ins)
 void
 LIRGenerator::visitBoundsCheck(MBoundsCheck* ins)
 {
-     if (!ins->fallible())
-         return;
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+    MOZ_ASSERT(ins->length()->type() == MIRType::Int32);
+    MOZ_ASSERT(ins->type() == MIRType::Int32);
+
+    if (!ins->fallible())
+        return;
 
     LInstruction* check;
     if (ins->minimum() || ins->maximum()) {
@@ -2952,6 +2956,8 @@ LIRGenerator::visitBoundsCheck(MBoundsCheck* ins)
 void
 LIRGenerator::visitBoundsCheckLower(MBoundsCheckLower* ins)
 {
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+
     if (!ins->fallible())
         return;
 

js/src/jit/MIR.h

@@ -9379,7 +9379,7 @@ class MNot
 // (unsigned comparisons may be used).
 class MBoundsCheck
   : public MBinaryInstruction,
-    public NoTypePolicy::Data
+    public MixPolicy<IntPolicy<0>, IntPolicy<1>>::Data
 {
     // Range over which to perform the bounds check, may be modified by GVN.
     int32_t minimum_;
@@ -9450,7 +9450,7 @@ class MBoundsCheck
 // Bailout if index < minimum.
 class MBoundsCheckLower
   : public MUnaryInstruction,
-    public NoTypePolicy::Data
+    public IntPolicy<0>::Data
 {
     int32_t minimum_;
     bool fallible_;

js/src/jit/TypePolicy.cpp

@@ -1236,6 +1236,7 @@ FilterTypeSetPolicy::adjustInputs(TempAllocator& alloc, MInstruction* ins)
     _(MixPolicy<ConvertToStringPolicy<0>, ConvertToStringPolicy<1> >)   \
     _(MixPolicy<ConvertToStringPolicy<0>, ObjectPolicy<1> >)            \
     _(MixPolicy<DoublePolicy<0>, DoublePolicy<1> >)                     \
+    _(MixPolicy<IntPolicy<0>, IntPolicy<1> >)                           \
     _(MixPolicy<ObjectPolicy<0>, BoxPolicy<1> >)                        \
     _(MixPolicy<ObjectPolicy<0>, CacheIdPolicy<1>>)                     \
     _(MixPolicy<ObjectPolicy<0>, ConvertToStringPolicy<1> >)            \