| Index: src/ia32/ic-ia32.cc
|
| diff --git a/src/ia32/ic-ia32.cc b/src/ia32/ic-ia32.cc
|
| index 3c95356642b42a2d90c6a1ec1e9679e870bb1580..a7c9ee8d0f52483e935d72c38f84d8fff6a00582 100644
|
| --- a/src/ia32/ic-ia32.cc
|
| +++ b/src/ia32/ic-ia32.cc
|
| @@ -765,7 +765,7 @@ void KeyedStoreIC::GenerateGeneric(MacroAssembler* masm,
|
| // ecx: key (a smi)
|
| // edi: receiver map
|
| __ mov(ebx, FieldOperand(edx, JSObject::kElementsOffset));
|
| - // Check that the object is in fast mode and writable.
|
| + // Check array bounds. Both the key and the length of FixedArray are smis.
|
| __ cmp(ecx, FieldOperand(ebx, FixedArray::kLengthOffset));
|
| __ j(below, &fast_object_with_map_check);
|
|
|
|
|