Bug 1195590 - Fix treating saved frame bit as part of the frame type. r=djvj, a=sylvestre
authorSean Stangl <sstangl@mozilla.com>
Mon, 24 Aug 2015 11:50:04 -0700
changeset 289178 c3fec00fc2bd05638483035bb303ec9602176b56
parent 289177 77513059a6e4425a19d1c803fcb8225522c375d6
child 289179 ada03589e5eae255a91c33611b0f5a11e7e81df3
push id5067
push userraliiev@mozilla.com
push dateMon, 21 Sep 2015 14:04:52 +0000
treeherdermozilla-beta@14221ffe5b2f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdjvj, sylvestre
bugs1195590
milestone42.0a2
Bug 1195590 - Fix treating saved frame bit as part of the frame type. r=djvj, a=sylvestre
js/src/jit/arm/Trampoline-arm.cpp
--- a/js/src/jit/arm/Trampoline-arm.cpp
+++ b/js/src/jit/arm/Trampoline-arm.cpp
@@ -1142,17 +1142,17 @@ JitRuntime::generateProfilerExitFrameTai
 #endif
 
     // Load the frame descriptor into |scratch1|, figure out what to do depending on its type.
     masm.loadPtr(Address(StackPointer, JitFrameLayout::offsetOfDescriptor()), scratch1);
 
     // Going into the conditionals, we will have:
     //      FrameDescriptor.size in scratch1
     //      FrameDescriptor.type in scratch2
-    masm.ma_and(Imm32((1 << FRAMESIZE_SHIFT) - 1), scratch1, scratch2);
+    masm.ma_and(Imm32((1 << FRAMETYPE_BITS) - 1), scratch1, scratch2);
     masm.rshiftPtr(Imm32(FRAMESIZE_SHIFT), scratch1);
 
     // Handling of each case is dependent on FrameDescriptor.type
     Label handle_IonJS;
     Label handle_BaselineStub;
     Label handle_Rectifier;
     Label handle_IonAccessorIC;
     Label handle_Entry;