wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 902722 - Guard typed arrays' shape instead of clasps in ICs. (r=jandem)

Browse Source
This commit is contained in:
Shu-yu Guo 2013-08-09 17:07:50 -07:00
parent 7362ecfb80
commit ffc54d673f
1 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
js/src/jit/IonCaches.cpp
View File

@ -2311,14 +2311,13 @@ GenerateTypedArrayElement(JSContext *cx, MacroAssembler &masm, IonCache::StubAtt
// The array type is the object within the table of typed array classes.
int arrayType = tarr->type();
Register tmpReg = output.scratchReg().gpr();
JS_ASSERT(tmpReg != InvalidReg);
// Check that the typed array is of the same type as the current object
// because load size differ in function of the typed array data width.
masm.branchTestObjClass(Assembler::NotEqual, object, tmpReg, tarr->getClass(), &failures);
// Guard on the shape.
Shape *shape = tarr->lastProperty();
masm.branchTestObjShape(Assembler::NotEqual, object, shape, &failures);
// Decide to what type index the stub should be optimized
Register tmpReg = output.scratchReg().gpr();
JS_ASSERT(tmpReg != InvalidReg);
Register indexReg = tmpReg;
JS_ASSERT(!index.constant());
if (idval.isString()) {