Bug 850099 - Fix StoreTypedArrayElementHole to handle constant length. r=djvj

This commit is contained in:
Jan de Mooij 2013-03-26 20:56:28 +01:00
parent e08e42b1df
commit d3093ff92f
2 changed files with 8 additions and 1 deletions

View File

@ -5369,7 +5369,10 @@ CodeGenerator::visitStoreTypedArrayElementHole(LStoreTypedArrayElementHole *lir)
StoreToTypedArray(masm, arrayType, value, dest);
} else {
Register idxReg = ToRegister(lir->index());
if (guardLength)
JS_ASSERT(guardLength);
if (lir->length()->isConstant())
masm.branch32(Assembler::AboveOrEqual, idxReg, Imm32(ToInt32(lir->length())), &skip);
else
masm.branch32(Assembler::BelowOrEqual, ToOperand(lir->length()), idxReg, &skip);
BaseIndex dest(elements, ToRegister(lir->index()), ScaleFromElemWidth(width));
StoreToTypedArray(masm, arrayType, value, dest);

View File

@ -0,0 +1,4 @@
var buf = serialize(-1);
var nbuf = serialize(undefined);
for (var j = 0 ; j < 5; j++)
buf[j + 8] = nbuf[j];