Fix assert when storing undefined to a slot (bug 708782, r=jandem).
authorDavid Anderson <danderson@mozilla.com>
Tue, 27 Dec 2011 14:08:15 -0800
changeset 84070 b235c328a6d975c40cac612cdbd7ef1d4c184a3f
parent 84069 eaaf33ed43c0c418af4fa16ea6e08fa49a3cc909
child 84071 32b53718b18e38628186c5a9fdc3984c15a12171
push id391
push userdanderson@mozilla.com
push dateTue, 27 Dec 2011 22:13:09 +0000
reviewersjandem
bugs708782
milestone12.0a1
Fix assert when storing undefined to a slot (bug 708782, r=jandem).
js/src/ion/arm/CodeGenerator-arm.cpp
js/src/ion/x86/CodeGenerator-x86.cpp
--- a/js/src/ion/arm/CodeGenerator-arm.cpp
+++ b/js/src/ion/arm/CodeGenerator-arm.cpp
@@ -1273,17 +1273,17 @@ CodeGeneratorARM::visitStoreSlotT(LStore
 
     if (valueType == MIRType_Double) {
         masm.ma_vstr(ToFloatRegister(value), Operand(base, offset));
         return true;
     }
 
     // Store the type tag if needed.
     if (valueType != store->mir()->slotType())
-        masm.storeTypeTag(ImmTag(MIRTypeToTag(valueType)), Operand(base, offset));
+        masm.storeTypeTag(ImmType(ValueTypeFromMIRType(valueType)), Operand(base, offset));
 
     // Store the payload.
     if (value->isConstant())
         masm.storePayload(*value->toConstant(), Operand(base, offset));
     else
         masm.storePayload(ToRegister(value), Operand(base, offset));
 
     return true;
--- a/js/src/ion/x86/CodeGenerator-x86.cpp
+++ b/js/src/ion/x86/CodeGenerator-x86.cpp
@@ -264,17 +264,17 @@ CodeGeneratorX86::visitStoreSlotT(LStore
 
     if (valueType == MIRType_Double) {
         masm.movsd(ToFloatRegister(value), Operand(base, offset));
         return true;
     }
 
     // Store the type tag if needed.
     if (valueType != store->mir()->slotType())
-        masm.storeTypeTag(ImmTag(MIRTypeToTag(valueType)), Operand(base, offset));
+        masm.storeTypeTag(ImmType(ValueTypeFromMIRType(valueType)), Operand(base, offset));
 
     // Store the payload.
     if (value->isConstant())
         masm.storePayload(*value->toConstant(), Operand(base, offset));
     else
         masm.storePayload(ToRegister(value), Operand(base, offset));
 
     return true;