Bug 1143216 - Do not replace recovered on bailout instructions with effective addresses equivalent. r=sunfish

js/src/jit-test/tests/ion/bug1143216.js

@@ -0,0 +1,17 @@
+// Note: This test produces a link error which is required to reproduce the
+// original issue.
+m = (function(stdlib, n, heap) {
+    "use asm"
+    var Float64ArrayView = new stdlib.Float64Array(heap)
+    var Int16ArrayView = new stdlib.Int16Array(heap)
+    function f(i0) {
+        i0 = i0 | 0
+        i0 = i0 | 0
+        Int16ArrayView[0] = (i0 << 0) + i0
+        Float64ArrayView[0]
+    }
+    return f
+})(this, {}, Array)
+for (var j = 0; j < 9; j++) {
+    m()
+}

js/src/jit/EffectiveAddressAnalysis.cpp

@@ -17,6 +17,9 @@ AnalyzeLsh(TempAllocator &alloc, MLsh *lsh)
     if (lsh->specialization() != MIRType_Int32)
         return;
 
+    if (lsh->isRecoveredOnBailout())
+        return;
+
     MDefinition *index = lsh->lhs();
     MOZ_ASSERT(index->type() == MIRType_Int32);
 
@@ -56,6 +59,8 @@ AnalyzeLsh(TempAllocator &alloc, MLsh *lsh)
         }
 
         last = add;
+        if (last->isRecoveredOnBailout())
+            return;
     }
 
     if (!base) {
@@ -71,6 +76,9 @@ AnalyzeLsh(TempAllocator &alloc, MLsh *lsh)
             return;
 
         MBitAnd *bitAnd = use->consumer()->toDefinition()->toBitAnd();
+        if (bitAnd->isRecoveredOnBailout())
+            return;
+
         MDefinition *other = bitAnd->getOperand(1 - bitAnd->indexOf(*use));
         if (!other->isConstantValue() || !other->constantValue().isInt32())
             return;
@@ -84,6 +92,9 @@ AnalyzeLsh(TempAllocator &alloc, MLsh *lsh)
         return;
     }
 
+    if (base->isRecoveredOnBailout())
+        return;
+
     MEffectiveAddress *eaddr = MEffectiveAddress::New(alloc, base, index, scale, displacement);
     last->replaceAllUsesWith(eaddr);
     last->block()->insertAfter(last, eaddr);