Bug 862932 - Fix inlineUnsafeSetTypedArrayElement to match other inlined array ops. r=nmatsakis
authorFelix S. Klock II <pnkfelix@pnkfx.org>
Wed, 17 Apr 2013 14:58:07 +0200
changeset 140564 5a12236dba8571a77112a3b12170c9bc3090c3ab
parent 140563 9dff432b752103947a83341d2ffaf346927a9e86
child 140565 8b1a7228674af2f0470f2fbe3c52f69fe78b5e58
child 140572 a4ab443b1eb19bd9ef1dabcea5f215f55c4a11cf
push id2579
push userakeybl@mozilla.com
push dateMon, 24 Jun 2013 18:52:47 +0000
treeherdermozilla-beta@b69b7de8a05a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnmatsakis
bugs862932
milestone23.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 862932 - Fix inlineUnsafeSetTypedArrayElement to match other inlined array ops. r=nmatsakis
js/src/ion/MCallOptimize.cpp
--- a/js/src/ion/MCallOptimize.cpp
+++ b/js/src/ion/MCallOptimize.cpp
@@ -1022,19 +1022,19 @@ IonBuilder::inlineUnsafeSetTypedArrayEle
                                              uint32_t base,
                                              int arrayType)
 {
     // Note: we do not check the conditions that are asserted as true
     // in intrinsic_UnsafeSetElement():
     // - arr is a typed array
     // - idx < length
 
-    uint32_t arri = base + 1;
-    uint32_t idxi = base + 2;
-    uint32_t elemi = base + 3;
+    uint32_t arri = base + 0;
+    uint32_t idxi = base + 1;
+    uint32_t elemi = base + 2;
 
     MInstruction *elements = getTypedArrayElements(callInfo.getArg(arri));
     current->add(elements);
 
     MToInt32 *id = MToInt32::New(callInfo.getArg(idxi));
     current->add(id);
 
     MDefinition *value = callInfo.getArg(elemi);