[JAEGER] Bug 586538 followup: the original fix was accidentally backed out by 91257f67ea38, so restoring it.
authorDavid Mandelin <dmandelin@mozilla.com>
Fri, 13 Aug 2010 14:10:43 -0700
changeset 53421 ef8903b263d3b1c3cc4978c8aabf6210820de473
parent 53420 abca9f5c49d1476f5d661c8adf0f47118ada4cd9
child 53422 d7b81bd995c3dcad118febc2333d73fcce5a542e
push idunknown
push userunknown
push dateunknown
bugs586538
milestone2.0b4pre
[JAEGER] Bug 586538 followup: the original fix was accidentally backed out by 91257f67ea38, so restoring it.
js/src/methodjit/Compiler.cpp
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -2775,17 +2775,18 @@ mjit::Compiler::jsop_name(JSAtom *atom)
     pic.hasTypeCheck = false;
     pic.fastPathStart = masm.label();
 
     pic.shapeGuard = masm.label();
     Jump j = masm.jump();
     DBGLABEL(dbgJumpOffset);
     {
         pic.slowPathStart = stubcc.masm.label();
-        stubcc.linkExit(j, Uses(0));
+        stubcc.linkExitDirect(j, pic.slowPathStart);
+        frame.sync(stubcc.masm, Uses(0));
         stubcc.leave();
         stubcc.masm.move(Imm32(pics.length()), Registers::ArgReg1);
         pic.callReturn = stubcc.call(ic::Name);
     }
 
     pic.storeBack = masm.label();
     frame.pushRegs(pic.shapeReg, pic.objReg);