| Index: bleeding_edge/src/ia32/codegen-ia32.cc
|
| ===================================================================
|
| --- bleeding_edge/src/ia32/codegen-ia32.cc (revision 3516)
|
| +++ bleeding_edge/src/ia32/codegen-ia32.cc (working copy)
|
| @@ -6662,18 +6662,14 @@
|
|
|
| // Load boilerplate object into ecx and check if we need to create a
|
| // boilerplate.
|
| + Label slow_case;
|
| __ mov(ecx, Operand(esp, 3 * kPointerSize));
|
| __ mov(eax, Operand(esp, 2 * kPointerSize));
|
| - ASSERT(kPointerSize == 4);
|
| - __ mov(ecx, FieldOperand(ecx,
|
| - eax,
|
| - times_2,
|
| - FixedArray::kHeaderSize));
|
| + ASSERT((kPointerSize == 4) && (kSmiTagSize == 1) && (kSmiTag == 0));
|
| + __ mov(ecx, FieldOperand(ecx, eax, times_2, FixedArray::kHeaderSize));
|
| __ cmp(ecx, Factory::undefined_value());
|
| - Label slow_case;
|
| __ j(equal, &slow_case);
|
|
|
| -
|
| // Allocate both the JS array and the elements array in one big
|
| // allocation. This avoids multiple limit checks.
|
| __ AllocateInNewSpace(size, eax, ebx, edx, &slow_case, TAG_OBJECT);
|
|
|