Fix assert in typed array IC (bug 624518, r=cdleary).
authorDavid Anderson <danderson@mozilla.com>
Tue, 11 Jan 2011 12:16:44 -0800
changeset 60556 64139fb1b3fe1a860db25cffbf3f871d8052fc16
parent 60555 b55e045d0fc3612600e16e9be3bff31a72b5b4e4
child 60557 39bac86bb16810fa727a514f3ec34e93530c31ce
push id18037
push usercleary@mozilla.com
push dateFri, 14 Jan 2011 17:42:55 +0000
treeherdermozilla-central@4e0501a0c5e5 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerscdleary
bugs624518
milestone2.0b9pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Fix assert in typed array IC (bug 624518, r=cdleary).
js/src/methodjit/TypedArrayIC.h
--- a/js/src/methodjit/TypedArrayIC.h
+++ b/js/src/methodjit/TypedArrayIC.h
@@ -256,17 +256,19 @@ GenConversionForIntArray(Assembler &masm
     if (vr.isConstant()) {
         // Constants are always folded to ints up-front.
         JS_ASSERT(vr.knownType() == JSVAL_TYPE_INT32);
         return;
     }
 
     if (!vr.isTypeKnown() || vr.knownType() != JSVAL_TYPE_INT32) {
         // If a conversion is necessary, save registers now.
-        Jump checkInt32 = masm.testInt32(Assembler::Equal, vr.typeReg());
+        MaybeJump checkInt32;
+        if (!vr.isTypeKnown())
+            checkInt32 = masm.testInt32(Assembler::Equal, vr.typeReg());
 
         // Store the value to convert.
         StackMarker vp = masm.allocStack(sizeof(Value), sizeof(double));
         masm.storeValue(vr, masm.addressOfExtra(vp));
 
         // Preserve volatile registers.
         PreserveRegisters saveForCall(masm);
         saveForCall.preserve(saveMask & Registers::TempRegs);
@@ -283,17 +285,18 @@ GenConversionForIntArray(Assembler &masm
             stub = stubs::ConvertToTypedInt<false>;
         masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, stub));
         if (vr.dataReg() != Registers::ReturnReg)
             masm.move(Registers::ReturnReg, vr.dataReg());
 
         saveForCall.restore();
         masm.freeStack(vp);
 
-        checkInt32.linkTo(masm.label(), &masm);
+        if (checkInt32.isSet())
+            checkInt32.get().linkTo(masm.label(), &masm);
     }
 
     // Performing clamping, if needed.
     if (tarray->type == js::TypedArray::TYPE_UINT8_CLAMPED) {
         //     cmp dr, 0
         //     jge _min
         //     mov dr, 0
         //     jump _done