commit 71a0e59c9902c90b02ba0a2897ad1a23a60be472
Author: Jan de Mooij <[email protected]>
Date: Fri Apr 4 19:38:10 2014 +0200
Bug 986678 - Fix type check in TryAddTypeBarrierForWrite. r=bhackett,
a=abillings
---
js/src/jit/MIR.cpp | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index eea62ff..ef20000 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -2701,10 +2701,10 @@ TryAddTypeBarrierForWrite(JSContext *cx, MBasicBlock
*current, types::StackTypeS
case MIRType_String: {
// The property is a particular primitive type, guard by unboxing the
// value before the write.
- if ((*pvalue)->type() != MIRType_Value) {
- // The value is a different primitive, just do a VM call as it will
- // always trigger invalidation of the compiled code.
- JS_ASSERT((*pvalue)->type() != propertyType);
+ if (!(*pvalue)->mightBeType(propertyType)) {
+ // The value's type does not match the property type. Just do a VM
+ // call as it will always trigger invalidation of the compiled
code.
+ JS_ASSERT_IF((*pvalue)->type() != MIRType_Value, (*pvalue)->type()
!= propertyType);
return false;
}
MInstruction *ins = MUnbox::New(*pvalue, propertyType,
MUnbox::Fallible);
_______________________________________________
tor-commits mailing list
[email protected]
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits
