Fix for issue 16497 - fix load elimination aliasing for typed arrays

sdk/lib/_internal/compiler/implementation/js_backend/backend.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of js_backend;
 
 const VERBOSE_OPTIMIZER_HINTS = false;
 
 class JavaScriptItemCompilationContext extends ItemCompilationContext {
   final Set<HInstruction> boundsChecked = new Set<HInstruction>();
@@ skipping 1720 matching lines @@
   bool isTypedArray(TypeMask mask) {
     // Just checking for [:TypedData:] is not sufficient, as it is an
     // abstract class any user-defined class can implement. So we also
     // check for the interface [JavaScriptIndexingBehavior].
     return compiler.typedDataClass != null
         && mask.satisfies(compiler.typedDataClass, compiler)
         && mask.satisfies(jsIndexingBehaviorInterface, compiler);
   }
 
   bool couldBeTypedArray(TypeMask mask) {
-    TypeMask indexing = new TypeMask.subtype(jsIndexingBehaviorInterface);
-    // Checking if [mask] contains [indexing] means that we want to
-    // know if [mask] is not a more specific type than [indexing].
-    return isTypedArray(mask) || mask.containsMask(indexing, compiler);
+    bool intersects(TypeMask type1, TypeMask type2) =>

[ngeoffray, 2014/02/05 09:25:53]

What is it that the previous implementation did not cover?

[sra1, 2014/02/05 21:32:18]

containsMask is a subtype test.
The inputs might not satisfy a subtype possibly be a typed array.
The example I saw was  union(NativeInt16List, JSUInt31).
The union type is not a subtype of JSIndexingBehavior, but still could be a
typed array.

If you wonder where that weird type comes from, look at:
https://codereview.chromium.org/155393002/

+        !type1.intersection(type2, compiler).isEmpty;
+
+    return compiler.typedDataClass != null
+        && intersects(mask, new TypeMask.subtype(compiler.typedDataClass))
+        && intersects(mask, new TypeMask.subtype(jsIndexingBehaviorInterface));
   }
 
   /// Returns all static fields that are referenced through [targetsUsed].
   /// If the target is a library or class all nested static fields are
   /// included too.
   Iterable<Element> _findStaticFieldTargets() {
     List staticFields = [];
 
     void addFieldsInContainer(ScopeContainerElement container) {
       container.forEachLocalMember((Element member) {
@@ skipping 152 matching lines @@
     copy(constant.values);
     copy(constant.protoValue);
     copy(constant);
   }
 
   void visitConstructed(ConstructedConstant constant) {
     copy(constant.fields);
     copy(constant);
   }
 }