Fix for issue 16497 - fix load elimination aliasing for typed arrays

sdk/lib/_internal/compiler/implementation/js_backend/backend.dart

Index: sdk/lib/_internal/compiler/implementation/js_backend/backend.dart
diff --git a/sdk/lib/_internal/compiler/implementation/js_backend/backend.dart b/sdk/lib/_internal/compiler/implementation/js_backend/backend.dart
index 35abf1ce879121bac08a65ded890548d4548ad89..36ddfa55cd3ca54374ce24368dfc1ac24e4d4d9a 100644
--- a/sdk/lib/_internal/compiler/implementation/js_backend/backend.dart
+++ b/sdk/lib/_internal/compiler/implementation/js_backend/backend.dart
@@ -1738,10 +1738,12 @@ class JavaScriptBackend extends Backend {
   }
 
   bool couldBeTypedArray(TypeMask mask) {
-    TypeMask indexing = new TypeMask.subtype(jsIndexingBehaviorInterface);
-    // Checking if [mask] contains [indexing] means that we want to
-    // know if [mask] is not a more specific type than [indexing].
-    return isTypedArray(mask) || mask.containsMask(indexing, compiler);
+    bool intersects(TypeMask type1, TypeMask type2) =>

[ngeoffray, 2014/02/05 09:25:53]

What is it that the previous implementation did not cover?

[sra1, 2014/02/05 21:32:18]

containsMask is a subtype test.
The inputs might not satisfy a subtype possibly be a typed array.
The example I saw was  union(NativeInt16List, JSUInt31).
The union type is not a subtype of JSIndexingBehavior, but still could be a
typed array.

If you wonder where that weird type comes from, look at:
https://codereview.chromium.org/155393002/

+        !type1.intersection(type2, compiler).isEmpty;
+
+    return compiler.typedDataClass != null
+        && intersects(mask, new TypeMask.subtype(compiler.typedDataClass))
+        && intersects(mask, new TypeMask.subtype(jsIndexingBehaviorInterface));
   }
 
   /// Returns all static fields that are referenced through [targetsUsed].