Title: [126082] trunk/Source/_javascript_Core
- Revision
- 126082
- Author
- [email protected]
- Date
- 2012-08-20 15:41:06 -0700 (Mon, 20 Aug 2012)
Log Message
fast/js/dfg-peephole-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html on 32-bit
https://bugs.webkit.org/show_bug.cgi?id=94538
Reviewed by Mark Hahnenberg.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (126081 => 126082)
--- trunk/Source/_javascript_Core/ChangeLog 2012-08-20 22:32:18 UTC (rev 126081)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-08-20 22:41:06 UTC (rev 126082)
@@ -1,5 +1,15 @@
2012-08-20 Filip Pizlo <[email protected]>
+ fast/js/dfg-peephole-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html on 32-bit
+ https://bugs.webkit.org/show_bug.cgi?id=94538
+
+ Reviewed by Mark Hahnenberg.
+
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+
+2012-08-20 Filip Pizlo <[email protected]>
+
fast/js/dfg-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html crashes on 32-bit
https://bugs.webkit.org/show_bug.cgi?id=94026
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (126081 => 126082)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2012-08-20 22:32:18 UTC (rev 126081)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2012-08-20 22:41:06 UTC (rev 126082)
@@ -1602,7 +1602,7 @@
// We know that within this branch, rightChild must not be a cell. Check if that is enough to
// prove that it is either null or undefined.
- if (isOtherSpeculation(m_state.forNode(rightChild).m_type & ~SpecCell))
+ if (isOtherOrEmptySpeculation(m_state.forNode(rightChild).m_type & ~SpecCell))
rightNotCell.link(&m_jit);
else {
jump(notTaken, ForceJump);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
