diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp index e484cab51eaf..5f55224b5bc1 100644 --- a/js/src/jit/CodeGenerator.cpp +++ b/js/src/jit/CodeGenerator.cpp @@ -5013,16 +5013,19 @@ CodeGenerator::visitBoundsCheckRange(LBoundsCheckRange *lir) masm.add32(Imm32(min), temp); if (!bailoutIf(Assembler::Overflow, lir->snapshot())) return false; + } + + masm.cmp32(temp, Imm32(0)); + if (!bailoutIf(Assembler::LessThan, lir->snapshot())) + return false; + + if (min != 0) { int32_t diff; if (SafeSub(max, min, &diff)) max = diff; else masm.sub32(Imm32(min), temp); } - - masm.cmp32(temp, Imm32(0)); - if (!bailoutIf(Assembler::LessThan, lir->snapshot())) - return false; } // Compute the maximum possible index. No overflow check is needed when