Bug 1138740 - Notify Ion when changing a typed array's data pointer due to making a lazy buffer for it, r=sfink.

js/src/jit-test/tests/ion/bug1138740.js

@@ -0,0 +1,12 @@
+
+with({}){}
+x = Int8Array(1)
+function f(y) {
+    x[0] = y
+}
+f()
+f(3)
+f(7)
+x.buffer;
+f(0);
+assertEq(x[0], 0);

js/src/vm/TypedArrayObject.cpp

@@ -120,6 +120,10 @@ TypedArrayObject::ensureHasBuffer(JSContext *cx, Handle<TypedArrayObject *> tarr
     tarray->setPrivate(buffer->dataPointer());
 
     tarray->setSlot(TypedArrayLayout::BUFFER_SLOT, ObjectValue(*buffer));
+
+    // Notify compiled jit code that the base pointer has moved.
+    MarkObjectStateChange(cx, tarray);
+
     return true;
 }