+2011-09-24 Filip Pizlo <fpizlo@apple.com>
+
+ JIT implementation of put_by_val increments m_length instead of setting
+ it to index+1
+ https://bugs.webkit.org/show_bug.cgi?id=68766
+
+ Reviewed by Geoffrey Garen.
+
+ * jit/JITPropertyAccess.cpp:
+ (JSC::JIT::emit_op_put_by_val):
+
2011-09-24 Geoffrey Garen <ggaren@apple.com>
More build fixage.
add32(TrustedImm32(1), Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
branch32(Below, regT1, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length))).linkTo(storeResult, this);
- add32(TrustedImm32(1), Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+ add32(TrustedImm32(1), regT1);
+ store32(regT1, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+ sub32(TrustedImm32(1), regT1);
jump().linkTo(storeResult, this);
end.link(this);