Fix typo when decoding RValues from Snapshots

TYPE_REG layout has the known type in arg1 and the GPR in arg2.

Comment on attachment 8395079 [details] [diff] [review] Fix typo in SnapshotIterator::allocationReadable Review of attachment 8395079 [details] [diff] [review]: ----------------------------------------------------------------- r=h4writer over IRC

remote: https://hg.mozilla.org/integration/mozilla-inbound/rev/6b7c6a1e963f

I found a testcase that seems fixed by this: $ ./js-dbg-64-ts-darwin-573ef29c7a9f --ion-parallel-compile=off --ion-eager testcase.js function f() { arguments.callee.caller.arguments yield } function g(a) { try { for (x in f()) {} } catch (e) {} } g('') Assertion failure: layoutFromMode(mode()).type1 == PAYLOAD_GPR, at jit/Snapshots.h and it was caused by: autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: http://hg.mozilla.org/mozilla-central/rev/a88353443251 user: Nicolas B. Pierron date: Tue Mar 18 08:31:24 2014 -0700 summary: Bug 962555 part 6 - IonMonkey: Simplify encoding & decoding of RValueAllocations. r=h4writer Was this patch intended to fix the issue? (and perhaps the testcase can be landed?)

Yeah, looks like the same bug. Feel free to land that.