From 31404beca95a86e89792e86445696cbd1d924ecd Mon Sep 17 00:00:00 2001 From: win7-7 Date: Mon, 12 Jan 2026 23:53:49 +0200 Subject: [PATCH] Fixes to VMFunctions.cpp, assert no longer crashes. Fixes to VMFunctions.cpp, assert no longer crashes. --- js/src/jit/BaselineCacheIRCompiler.cpp | 2 +- js/src/jit/IonCacheIRCompiler.cpp | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/js/src/jit/BaselineCacheIRCompiler.cpp b/js/src/jit/BaselineCacheIRCompiler.cpp index 7021433c3c..a376ffeb81 100644 --- a/js/src/jit/BaselineCacheIRCompiler.cpp +++ b/js/src/jit/BaselineCacheIRCompiler.cpp @@ -316,7 +316,7 @@ BaselineCacheIRCompiler::emitGuardSpecificAtom() // The pointers are not equal, so if the input string is also an atom it // must be a different string. - masm.branchTest32(Assembler::NonZero, Address(str, JSString::offsetOfFlags()), + masm.branchTest32(Assembler::Zero, Address(str, JSString::offsetOfFlags()), Imm32(JSString::NON_ATOM_BIT), failure->label()); // Check the length. diff --git a/js/src/jit/IonCacheIRCompiler.cpp b/js/src/jit/IonCacheIRCompiler.cpp index 3d49cf61dd..3c6c442c8f 100644 --- a/js/src/jit/IonCacheIRCompiler.cpp +++ b/js/src/jit/IonCacheIRCompiler.cpp @@ -684,7 +684,7 @@ IonCacheIRCompiler::emitGuardSpecificAtom() // The pointers are not equal, so if the input string is also an atom it // must be a different string. - masm.branchTest32(Assembler::NonZero, Address(str, JSString::offsetOfFlags()), + masm.branchTest32(Assembler::Zero, Address(str, JSString::offsetOfFlags()), Imm32(JSString::NON_ATOM_BIT), failure->label()); // Check the length.