Bug 1080542 - Follow base pointers properly for dependent strings in RegExp.exec stubs. r=jandem, a=sledru
authorBrian Hackett <bhackett1024@gmail.com>
Mon, 13 Oct 2014 08:09:28 -0700
changeset 233383 d32a3cd38858591a77cc6881b42000b89f2143d3
parent 233382 29c18591d6df5d3b001d52068a35225ea221091d
child 233384 da7bdb2b6ee32a2356e65fb159b773167513de8a
push id4187
push userbhearsum@mozilla.com
push dateFri, 28 Nov 2014 15:29:12 +0000
treeherdermozilla-beta@f23cc6a30c11 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, sledru
bugs1080542
milestone35.0a2
Bug 1080542 - Follow base pointers properly for dependent strings in RegExp.exec stubs. r=jandem, a=sledru
js/src/jit/CodeGenerator.cpp
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -1293,17 +1293,17 @@ CreateDependentString(MacroAssembler &ma
         masm.storePtr(base, Address(string, JSDependentString::offsetOfBase()));
 
         // Follow any base pointer if the input is itself a dependent string.
         // Watch for undepended strings, which have a base pointer but don't
         // actually share their characters with it.
         Label noBase;
         masm.branchTest32(Assembler::Zero, Address(base, JSString::offsetOfFlags()),
                           Imm32(JSString::HAS_BASE_BIT), &noBase);
-        masm.branchTest32(Assembler::Zero, Address(base, JSString::offsetOfFlags()),
+        masm.branchTest32(Assembler::NonZero, Address(base, JSString::offsetOfFlags()),
                           Imm32(JSString::FLAT_BIT), &noBase);
         masm.loadPtr(Address(base, JSDependentString::offsetOfBase()), temp1);
         masm.storePtr(temp1, Address(string, JSDependentString::offsetOfBase()));
         masm.bind(&noBase);
     }
 
     masm.bind(&done);
 }