Title: [278642] trunk/Source/_javascript_Core
- Revision
- 278642
- Author
- [email protected]
- Date
- 2021-06-08 19:32:47 -0700 (Tue, 08 Jun 2021)
Log Message
Fix speculated type in speculateNeitherDoubleNorHeapBigIntNorString
https://bugs.webkit.org/show_bug.cgi?id=226786
Reviewed by Mark Lam.
I had forgotten the HeapBigInt part.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (278641 => 278642)
--- trunk/Source/_javascript_Core/ChangeLog 2021-06-09 02:26:34 UTC (rev 278641)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-06-09 02:32:47 UTC (rev 278642)
@@ -1,3 +1,15 @@
+2021-06-08 Robin Morisset <[email protected]>
+
+ Fix speculated type in speculateNeitherDoubleNorHeapBigIntNorString
+ https://bugs.webkit.org/show_bug.cgi?id=226786
+
+ Reviewed by Mark Lam.
+
+ I had forgotten the HeapBigInt part.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString):
+
2021-06-06 Yusuke Suzuki <[email protected]>
[JSC] Use ResolvedClosureVar to get brand from scope
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (278641 => 278642)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2021-06-09 02:26:34 UTC (rev 278641)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2021-06-09 02:32:47 UTC (rev 278642)
@@ -11565,7 +11565,7 @@
void SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString(Edge edge, JSValueRegs regs, GPRReg tempGPR)
{
- if (!needsTypeCheck(edge, ~(SpecFullDouble | SpecString)))
+ if (!needsTypeCheck(edge, ~(SpecFullDouble | SpecString | SpecHeapBigInt)))
return;
MacroAssembler::JumpList done;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
