[JAEGER]
Bug 586538 followup: the original fix was accidentally backed out by 91257f67ea38, so restoring it.
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -2775,17 +2775,18 @@ mjit::Compiler::jsop_name(JSAtom *atom)
pic.hasTypeCheck = false;
pic.fastPathStart = masm.label();
pic.shapeGuard = masm.label();
Jump j = masm.jump();
DBGLABEL(dbgJumpOffset);
{
pic.slowPathStart = stubcc.masm.label();
- stubcc.linkExit(j, Uses(0));
+ stubcc.linkExitDirect(j, pic.slowPathStart);
+ frame.sync(stubcc.masm, Uses(0));
stubcc.leave();
stubcc.masm.move(Imm32(pics.length()), Registers::ArgReg1);
pic.callReturn = stubcc.call(ic::Name);
}
pic.storeBack = masm.label();
frame.pushRegs(pic.shapeReg, pic.objReg);