Bug 919118: Convert Float before conversion to Int32; r=sstangl

js/src/jit-test/tests/ion/bug919118.js

@@ -0,0 +1,13 @@
+setJitCompilerOption("ion.usecount.trigger", 50);
+
+var f32 = new Float32Array(1);
+f32[0] = 13;
+var str = "CAN HAS cheezburger? OKTHXBYE";
+var c;
+
+function f() {
+    c = str[ f32[0] ];
+}
+
+for(var n = 100; n; --n) f();
+print (c);

js/src/jit/MIR.h

@@ -2849,7 +2849,9 @@ class MAsmJSUnsignedToDouble
 // Converts a primitive (either typed or untyped) to an int32. If the input is
 // not primitive at runtime, a bailout occurs. If the input cannot be converted
 // to an int32 without loss (i.e. "5.5" or undefined) then a bailout occurs.
-class MToInt32 : public MUnaryInstruction
+class MToInt32
+  : public MUnaryInstruction,
+    public NoFloatPolicy<0>
 {
     bool canBeNegativeZero_;
 
@@ -2888,6 +2890,10 @@ class MToInt32 : public MUnaryInstruction
         return AliasSet::None();
     }
     void computeRange();
+
+    TypePolicy *typePolicy() {
+        return this;
+    }
 };
 
 // Converts a value or typed input to a truncated int32, for use with bitwise