Fix crash of language/expressions/object/setter-super-prop.js with JIT

Generally super.foo = bar calls the storeSuperProperty run-time method,
which expects the engine as the first parameter, not the function
pointer.

Amends commit d31541fd9d7d52ef3eae29e7e5d36733d7f55375

Change-Id: Ic0c933e855066273a635fe62ad88316c75cb8f45
Reviewed-by: Lars Knoll <lars.knoll@qt.io>

1 files changed, 1 insertions, 1 deletions

diff --git a/src/qml/jit/qv4baselinejit.cpp b/src/qml/jit/qv4baselinejit.cpp
index 9132b194a5..7200e44f0c 100644
--- a/src/qml/jit/qv4baselinejit.cpp
+++ b/src/qml/jit/qv4baselinejit.cpp
@@ -322,7 +322,7 @@ void BaselineJIT::generate_StoreSuperProperty(int property)
     as->prepareCallWithArgCount(3);
     as->passAccumulatorAsArg(2);
     as->passRegAsArg(property, 1);
-    as->passFunctionAsArg(0);
+    as->passEngineAsArg(0);
     JIT_GENERATE_RUNTIME_CALL(Runtime::method_storeSuperProperty, Assembler::IgnoreResult);
     as->checkException();
 }