[MERGE #5336 @Cellule] IsIn Array fast path with non-int 2.0

Merge pull request #5336 from Cellule:isin

OS#16717501

Author: Cellule

lib/Backend/Lower.cpp

@@ -20072,6 +20072,8 @@ void Lowerer::GenerateFastArrayIsIn(IR::Instr * instr)
 
     if (
         !src1->GetValueType().IsLikelyInt() ||
+        // Do not do a fast path if we know for sure we don't have an int
+        src1->IsNotInt() ||
         !src2->GetValueType().IsLikelyArray() ||
         !src2->GetValueType().HasNoMissingValues())
     {

test/Array/bug16717501.js

@@ -0,0 +1,17 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+function test0() {
+  for (var vnlgev in [1 .__parent__ = '']) {
+  }
+  // Value too big to be a tagged int on 32 bit platforms
+  return 1518500249 in [];
+}
+// Trigger jit
+for (let i = 0; i < 1000; ++i) {
+  test0();
+}
+
+console.log("pass");

test/Array/rlexe.xml

@@ -764,4 +764,9 @@
       <files>constructor_fastpath.js</files>
     </default>
   </test>
+  <test>
+    <default>
+      <files>bug16717501.js</files>
+    </default>
+  </test>
 </regress-exe>