[INFER] Load atom pointer for CallProp stub call, bug 645629. r=bhackett
authorJan de Mooij <jandemooij@gmail.com>
Tue, 29 Mar 2011 05:55:49 -0700
changeset 74859 3b5b4dfda144c0fbe7108174a882e311512ce3e6
parent 74858 9980055fd19ca13749807ad087a47ceb4e834446
child 74860 93b8d39804d7a1d32d811470d883d5aed6855559
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
reviewersbhackett
bugs645629
milestone2.0b13pre
[INFER] Load atom pointer for CallProp stub call, bug 645629. r=bhackett
js/src/jit-test/tests/jaeger/bug645629.js
js/src/methodjit/Compiler.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/bug645629.js
@@ -0,0 +1,8 @@
+/* Don't assert. */
+o1 = {};
+o1 = 2;
+function f(o) {
+    o.hasOwnProperty("x");
+}
+new f(o1);
+f(o1);
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -4483,16 +4483,17 @@ mjit::Compiler::jsop_callprop(JSAtom *at
         // THIS THIS FUN
 
         frame.shift(-2);
         // FUN THIS
 
         if (notObject.isSet()) {
             stubcc.linkExit(notObject.get(), Uses(1));
             stubcc.leave();
+            stubcc.masm.move(ImmPtr(atom), Registers::ArgReg1);
             OOL_STUBCALL(stubs::CallProp);
             stubcc.rejoin(Changes(2));
         }
 
         return true;
     }
 
     /* If the incoming type will never PIC, take slow path. */