Commit 766f19eb authored by fpizlo@apple.com's avatar fpizlo@apple.com

JIT implementation of put_by_val increments m_length instead of setting

it to index+1
https://bugs.webkit.org/show_bug.cgi?id=68766

Reviewed by Geoffrey Garen.

* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_put_by_val):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95918 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 3da2c09e
2011-09-24 Filip Pizlo <fpizlo@apple.com>
JIT implementation of put_by_val increments m_length instead of setting
it to index+1
https://bugs.webkit.org/show_bug.cgi?id=68766
Reviewed by Geoffrey Garen.
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_put_by_val):
2011-09-24 Geoffrey Garen <ggaren@apple.com>
More build fixage.
......@@ -215,7 +215,9 @@ void JIT::emit_op_put_by_val(Instruction* currentInstruction)
add32(TrustedImm32(1), Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
branch32(Below, regT1, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length))).linkTo(storeResult, this);
add32(TrustedImm32(1), Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)));
add32(TrustedImm32(1), regT1);
store32(regT1, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)));
sub32(TrustedImm32(1), regT1);
jump().linkTo(storeResult, this);
end.link(this);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment