Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-14 05:45:37 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix assert in typed array IC (bug 624518, r=cdleary).

Browse Source
This commit is contained in:
David Anderson 2011-01-11 12:16:44 -08:00
parent 7c3850ddd4
commit 6390a68543
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
js/src/methodjit/TypedArrayIC.h
View File

@ -261,7 +261,9 @@ GenConversionForIntArray(Assembler &masm, js::TypedArray *tarray, const ValueRem
if (!vr.isTypeKnown() || vr.knownType() != JSVAL_TYPE_INT32) {
// If a conversion is necessary, save registers now.
Jump checkInt32 = masm.testInt32(Assembler::Equal, vr.typeReg());
MaybeJump checkInt32;
if (!vr.isTypeKnown())
checkInt32 = masm.testInt32(Assembler::Equal, vr.typeReg());
// Store the value to convert.
StackMarker vp = masm.allocStack(sizeof(Value), sizeof(double));
@ -288,7 +290,8 @@ GenConversionForIntArray(Assembler &masm, js::TypedArray *tarray, const ValueRem
saveForCall.restore();
masm.freeStack(vp);
checkInt32.linkTo(masm.label(), &masm);
if (checkInt32.isSet())
checkInt32.get().linkTo(masm.label(), &masm);
}
// Performing clamping, if needed.