From c373a9c77a03c6eb72bf508f3d15b67d6a3064fe Mon Sep 17 00:00:00 2001
From: David Anderson <danderson@mozilla.com>
Date: Fri, 15 Jan 2010 12:05:01 -0800
Subject: [PATCH] Fixed x64 assertion in tracing JSOP_LENGTH on arguments (bug
 539965, r=dmandelin).

---
 js/src/jstracer.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp
index 909afd1cbdf0..3e40b7179704 100644
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -14840,7 +14840,7 @@ TraceRecorder::record_JSOP_LENGTH()
 
         // slot_ins is the value from the slot; right-shift by 2 bits to get
         // the length (see GetArgsLength in jsfun.cpp).
-        LIns* v_ins = lir->ins1(LIR_i2f, lir->ins2i(LIR_rsh, slot_ins, 2));
+        LIns* v_ins = lir->ins1(LIR_i2f, lir->ins2i(LIR_rsh, p2i(slot_ins), 2));
         set(&l, v_ins);
         return ARECORD_CONTINUE;
     }