commit 71a0e59c9902c90b02ba0a2897ad1a23a60be472 Author: Jan de Mooij jdemooij@mozilla.com Date: Fri Apr 4 19:38:10 2014 +0200

Bug 986678 - Fix type check in TryAddTypeBarrierForWrite. r=bhackett, a=abillings --- js/src/jit/MIR.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp index eea62ff..ef20000 100644 --- a/js/src/jit/MIR.cpp +++ b/js/src/jit/MIR.cpp @@ -2701,10 +2701,10 @@ TryAddTypeBarrierForWrite(JSContext *cx, MBasicBlock *current, types::StackTypeS case MIRType_String: { // The property is a particular primitive type, guard by unboxing the // value before the write. - if ((*pvalue)->type() != MIRType_Value) { - // The value is a different primitive, just do a VM call as it will - // always trigger invalidation of the compiled code. - JS_ASSERT((*pvalue)->type() != propertyType); + if (!(*pvalue)->mightBeType(propertyType)) { + // The value's type does not match the property type. Just do a VM + // call as it will always trigger invalidation of the compiled code. + JS_ASSERT_IF((*pvalue)->type() != MIRType_Value, (*pvalue)->type() != propertyType); return false; } MInstruction *ins = MUnbox::New(*pvalue, propertyType, MUnbox::Fallible);