wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 850099 - Fix StoreTypedArrayElementHole to handle constant length. r=djvj

Browse Source
This commit is contained in:
Jan de Mooij 2013-03-26 20:56:28 +01:00
parent 799355e0c1
commit 2f932d1d4c
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
js/src/ion/CodeGenerator.cpp
View File

@ -5369,7 +5369,10 @@ CodeGenerator::visitStoreTypedArrayElementHole(LStoreTypedArrayElementHole *lir)
StoreToTypedArray(masm, arrayType, value, dest);
} else {
Register idxReg = ToRegister(lir->index());
if (guardLength)
JS_ASSERT(guardLength);
if (lir->length()->isConstant())
masm.branch32(Assembler::AboveOrEqual, idxReg, Imm32(ToInt32(lir->length())), &skip);
else
masm.branch32(Assembler::BelowOrEqual, ToOperand(lir->length()), idxReg, &skip);
BaseIndex dest(elements, ToRegister(lir->index()), ScaleFromElemWidth(width));
StoreToTypedArray(masm, arrayType, value, dest);

4
js/src/jit-test/tests/ion/bug850099.js Normal file
View File

@ -0,0 +1,4 @@
var buf = serialize(-1);
var nbuf = serialize(undefined);
for (var j = 0 ; j < 5; j++)
buf[j + 8] = nbuf[j];