Fix pinReg() around copyDataIntoReg() in jsop_bitop(). b=600419, r=dvander.

This commit is contained in:
Sean Stangl 2010-10-04 13:30:46 -04:00
parent 39060e35d5
commit 0d02e95a3d
2 changed files with 7 additions and 2 deletions

View File

@ -524,14 +524,14 @@ mjit::Compiler::jsop_bitop(JSOp op)
RegisterID rr = frame.tempRegForData(rhs);
#endif
frame.pinReg(rr);
if (lhs->isConstant()) {
frame.pinReg(rr);
reg = frame.allocReg();
masm.move(Imm32(lhs->getValue().toInt32()), reg);
frame.unpinReg(rr);
} else {
reg = frame.copyDataIntoReg(lhs);
}
frame.unpinReg(rr);
if (op == JSOP_LSH) {
masm.lshift32(rr, reg);

View File

@ -0,0 +1,5 @@
/* Don't assert. */
(function() {
var x;
[1].map(function(){}, x << x);
})()