From 455c57653babca888935846f61ae39cfef01ae2a Mon Sep 17 00:00:00 2001
From: Douglas Crosher <dtc-moz@scieneer.com>
Date: Tue, 3 Jun 2014 16:39:31 +1000
Subject: [PATCH] Bug 1019414 - IonMonkey: The exitCodePatch offset needs to be
 converted to its final offset after assembly. r=jandem

---
 js/src/jit/IonMacroAssembler.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/js/src/jit/IonMacroAssembler.h b/js/src/jit/IonMacroAssembler.h
index d98c13d28860..4d609be9b65d 100644
--- a/js/src/jit/IonMacroAssembler.h
+++ b/js/src/jit/IonMacroAssembler.h
@@ -905,6 +905,7 @@ class MacroAssembler : public MacroAssemblerSpecific
         // the JitCode onto the stack in order to GC it correctly.  exitCodePatch should
         // be unset if the code never needed to push its JitCode*.
         if (hasEnteredExitFrame()) {
+            exitCodePatch_.fixup(this);
             patchDataWithValueCheck(CodeLocationLabel(code, exitCodePatch_),
                                     ImmPtr(code),
                                     ImmPtr((void*)-1));