Title: [150144] branches/dfgFourthTier/Source/_javascript_Core
- Revision
- 150144
- Author
- [email protected]
- Date
- 2013-05-15 13:43:40 -0700 (Wed, 15 May 2013)
Log Message
Fix for broken 32-bit build in SpeculativeJIT::checkArray().
https://bugs.webkit.org/show_bug.cgi?id=116184.
Rubber stamped by Mark Hahnenberg.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::checkArray):
Modified Paths
Diff
Modified: branches/dfgFourthTier/Source/_javascript_Core/ChangeLog (150143 => 150144)
--- branches/dfgFourthTier/Source/_javascript_Core/ChangeLog 2013-05-15 20:30:12 UTC (rev 150143)
+++ branches/dfgFourthTier/Source/_javascript_Core/ChangeLog 2013-05-15 20:43:40 UTC (rev 150144)
@@ -1,3 +1,13 @@
+2013-05-15 Mark Lam <[email protected]>
+
+ Fix for broken 32-bit build in SpeculativeJIT::checkArray().
+ https://bugs.webkit.org/show_bug.cgi?id=116184.
+
+ Rubber stamped by Mark Hahnenberg.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::checkArray):
+
2013-05-15 Filip Pizlo <[email protected]>
fourthTier: DFG should separate link phase into things that must be done concurrently and things that must be done synchronously, and have a way of passing data from one to the other
Modified: branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (150143 => 150144)
--- branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-05-15 20:30:12 UTC (rev 150143)
+++ branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-05-15 20:43:40 UTC (rev 150144)
@@ -744,7 +744,7 @@
m_jit.loadPtr(
MacroAssembler::Address(baseReg, JSCell::structureOffset()), temp.gpr());
speculationCheck(
- BadType, JSValueRegs(baseReg), node,
+ BadType, JSValueSource::unboxedCell(baseReg), node,
m_jit.branchPtr(
MacroAssembler::NotEqual,
MacroAssembler::Address(temp.gpr(), Structure::classInfoOffset()),
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
