Fix assert in typed array IC (bug 624518, r=cdleary).

This commit is contained in:
David Anderson 2011-01-11 12:16:44 -08:00
parent 49b0d53f93
commit 33912b4457

View File

@ -261,7 +261,9 @@ GenConversionForIntArray(Assembler &masm, js::TypedArray *tarray, const ValueRem
if (!vr.isTypeKnown() || vr.knownType() != JSVAL_TYPE_INT32) {
// If a conversion is necessary, save registers now.
Jump checkInt32 = masm.testInt32(Assembler::Equal, vr.typeReg());
MaybeJump checkInt32;
if (!vr.isTypeKnown())
checkInt32 = masm.testInt32(Assembler::Equal, vr.typeReg());
// Store the value to convert.
StackMarker vp = masm.allocStack(sizeof(Value), sizeof(double));
@ -288,7 +290,8 @@ GenConversionForIntArray(Assembler &masm, js::TypedArray *tarray, const ValueRem
saveForCall.restore();
masm.freeStack(vp);
checkInt32.linkTo(masm.label(), &masm);
if (checkInt32.isSet())
checkInt32.get().linkTo(masm.label(), &masm);
}
// Performing clamping, if needed.