Bug 980860: Fix fieldName comparison in TypeDescrSet::fieldNamed; r=nmatsakis

js/src/jit-test/tests/ion/bug980960.js

@@ -0,0 +1,34 @@
+if (typeof TypedObject === 'undefined')
+    quit();
+
+var StructType = TypedObject.StructType;
+var uint8 = TypedObject.uint8;
+
+function check(c) {
+  assertEq(c.r, 129);
+}
+
+function run() {
+  var RgbColor = new StructType({r: uint8, g: uint8, b: uint8});
+  var Fade = new StructType({from: RgbColor, to: RgbColor});
+
+  var BrgColor = new StructType({b: uint8, r: uint8, g: uint8});
+  var BrgFade = new StructType({from: BrgColor, to: BrgColor});
+
+  var gray = new RgbColor({r: 129, g: 128, b: 127});
+
+  var fade = new Fade({from: gray, to: gray});
+  fade.to = {r: 129, g: 128, b: 127};
+
+  var brgGray = new BrgColor(gray);
+  fade.from = brgGray;
+
+  var brgFade = new BrgFade(fade);
+
+  check(fade.to);
+  check(brgFade.to);
+  check(fade.to);
+  check(brgFade.to);
+}
+
+run();

js/src/jit/TypeDescrSet.cpp

@@ -337,7 +337,7 @@ TypeDescrSet::fieldNamed(IonBuilder &builder,
     // Check that all subsequent fields are at the same offset
     // and compute the union of their types.
     for (size_t i = 1; i < length(); i++) {
-        StructTypeDescr &descri = get(0)->as<StructTypeDescr>();
+        StructTypeDescr &descri = get(i)->as<StructTypeDescr>();
 
         size_t indexi;
         if (!descri.fieldIndex(id, &indexi))

js/src/jit/shared/CodeGenerator-x86-shared.cpp

@@ -451,7 +451,6 @@ CodeGeneratorX86Shared::visitOutOfLineBailout(OutOfLineBailout *ool)
     return true;
 }
 
-
 bool
 CodeGeneratorX86Shared::visitMinMaxD(LMinMaxD *ins)
 {