mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-11-05 16:46:26 +00:00
Bug 850099 - Fix StoreTypedArrayElementHole to handle constant length. r=djvj
This commit is contained in:
parent
e08e42b1df
commit
d3093ff92f
@ -5369,7 +5369,10 @@ CodeGenerator::visitStoreTypedArrayElementHole(LStoreTypedArrayElementHole *lir)
|
||||
StoreToTypedArray(masm, arrayType, value, dest);
|
||||
} else {
|
||||
Register idxReg = ToRegister(lir->index());
|
||||
if (guardLength)
|
||||
JS_ASSERT(guardLength);
|
||||
if (lir->length()->isConstant())
|
||||
masm.branch32(Assembler::AboveOrEqual, idxReg, Imm32(ToInt32(lir->length())), &skip);
|
||||
else
|
||||
masm.branch32(Assembler::BelowOrEqual, ToOperand(lir->length()), idxReg, &skip);
|
||||
BaseIndex dest(elements, ToRegister(lir->index()), ScaleFromElemWidth(width));
|
||||
StoreToTypedArray(masm, arrayType, value, dest);
|
||||
|
4
js/src/jit-test/tests/ion/bug850099.js
Normal file
4
js/src/jit-test/tests/ion/bug850099.js
Normal file
@ -0,0 +1,4 @@
|
||||
var buf = serialize(-1);
|
||||
var nbuf = serialize(undefined);
|
||||
for (var j = 0 ; j < 5; j++)
|
||||
buf[j + 8] = nbuf[j];
|
Loading…
Reference in New Issue
Block a user