[tbb-commits] [tor-browser/esr24] Bug 986678 - Fix type check in TryAddTypeBarrierForWrite. r=bhackett, a=abillings

[mikeperry at torproject.org]

commit 71a0e59c9902c90b02ba0a2897ad1a23a60be472
Author: Jan de Mooij <jdemooij at mozilla.com>
Date:   Fri Apr 4 19:38:10 2014 +0200

    Bug 986678 - Fix type check in TryAddTypeBarrierForWrite. r=bhackett, a=abillings
---
 js/src/jit/MIR.cpp |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index eea62ff..ef20000 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -2701,10 +2701,10 @@ TryAddTypeBarrierForWrite(JSContext *cx, MBasicBlock *current, types::StackTypeS
       case MIRType_String: {
         // The property is a particular primitive type, guard by unboxing the
         // value before the write.
-        if ((*pvalue)->type() != MIRType_Value) {
-            // The value is a different primitive, just do a VM call as it will
-            // always trigger invalidation of the compiled code.
-            JS_ASSERT((*pvalue)->type() != propertyType);
+        if (!(*pvalue)->mightBeType(propertyType)) {
+            // The value's type does not match the property type. Just do a VM
+            // call as it will always trigger invalidation of the compiled code.
+            JS_ASSERT_IF((*pvalue)->type() != MIRType_Value, (*pvalue)->type() != propertyType);
             return false;
         }
         MInstruction *ins = MUnbox::New(*pvalue, propertyType, MUnbox::Fallible);