The typed array ICs do not work with JM+TI's regalloc: - A volatile mask is saved when the IC is created, which may not correct if loop registers are allocated later. - Infallible calls are emitted in the IC stubs, which save/restore registers in a way that is not compatible with FP registers (and is different from the call mechanism everywhere else in JM). The fix for bug 643266 just disables these ICs, but they need to get fixed and reenabled.

Turn typed array ICs back on when inference is disabled, pretty simple to do now that the linear scan regalloc is also disabled when inference is disabled. http://hg.mozilla.org/projects/jaegermonkey/rev/152b2b6e6fb9