Title: [126081] trunk/Source/_javascript_Core
- Revision
- 126081
- Author
- [email protected]
- Date
- 2012-08-20 15:32:18 -0700 (Mon, 20 Aug 2012)
Log Message
fast/js/dfg-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html crashes on 32-bit
https://bugs.webkit.org/show_bug.cgi?id=94026
Reviewed by Mark Hahnenberg.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (126080 => 126081)
--- trunk/Source/_javascript_Core/ChangeLog 2012-08-20 22:24:35 UTC (rev 126080)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-08-20 22:32:18 UTC (rev 126081)
@@ -1,3 +1,13 @@
+2012-08-20 Filip Pizlo <[email protected]>
+
+ fast/js/dfg-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html crashes on 32-bit
+ https://bugs.webkit.org/show_bug.cgi?id=94026
+
+ Reviewed by Mark Hahnenberg.
+
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+
2012-08-19 Filip Pizlo <[email protected]>
The relationship between abstract values and structure transition watchpoints should be rationalized
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (126080 => 126081)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2012-08-20 22:24:35 UTC (rev 126080)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2012-08-20 22:32:18 UTC (rev 126081)
@@ -1530,7 +1530,7 @@
// We know that within this branch, rightChild must not be a cell. Check if that is enough to
// prove that it is either null or undefined.
- if (!isOtherSpeculation(m_state.forNode(rightChild).m_type & ~SpecCell)) {
+ if (!isOtherOrEmptySpeculation(m_state.forNode(rightChild).m_type & ~SpecCell)) {
m_jit.move(op2TagGPR, resultGPR);
m_jit.or32(TrustedImm32(1), resultGPR);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
