From e79c76bc4a3aa3127ebb879975ae94e8e435fd83 Mon Sep 17 00:00:00 2001
From: Benjamin Bouvier <bbouvier@mozilla.com>
Date: Tue, 24 Sep 2013 14:08:32 -0700
Subject: [PATCH] Bug 919118: Convert Float before conversion to Int32;
 r=sstangl

---
 js/src/jit-test/tests/ion/bug919118.js | 13 +++++++++++++
 js/src/jit/MIR.h                       |  8 +++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 js/src/jit-test/tests/ion/bug919118.js

diff --git a/js/src/jit-test/tests/ion/bug919118.js b/js/src/jit-test/tests/ion/bug919118.js
new file mode 100644
index 000000000000..31491292dbf3
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug919118.js
@@ -0,0 +1,13 @@
+setJitCompilerOption("ion.usecount.trigger", 50);
+
+var f32 = new Float32Array(1);
+f32[0] = 13;
+var str = "CAN HAS cheezburger? OKTHXBYE";
+var c;
+
+function f() {
+    c = str[ f32[0] ];
+}
+
+for(var n = 100; n; --n) f();
+print (c);
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index ea6a0f5d16b3..858c425db5f3 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -2849,7 +2849,9 @@ class MAsmJSUnsignedToDouble
 // Converts a primitive (either typed or untyped) to an int32. If the input is
 // not primitive at runtime, a bailout occurs. If the input cannot be converted
 // to an int32 without loss (i.e. "5.5" or undefined) then a bailout occurs.
-class MToInt32 : public MUnaryInstruction
+class MToInt32
+  : public MUnaryInstruction,
+    public NoFloatPolicy<0>
 {
     bool canBeNegativeZero_;
 
@@ -2888,6 +2890,10 @@ class MToInt32 : public MUnaryInstruction
         return AliasSet::None();
     }
     void computeRange();
+
+    TypePolicy *typePolicy() {
+        return this;
+    }
 };
 
 // Converts a value or typed input to a truncated int32, for use with bitwise