Title: [163391] trunk/Source/_javascript_Core
- Revision
- 163391
- Author
- [email protected]
- Date
- 2014-02-04 11:09:52 -0800 (Tue, 04 Feb 2014)
Log Message
ASSERT in speculateMachineInt on 32-bit platforms
https://bugs.webkit.org/show_bug.cgi?id=128155
Reviewed by Filip Pizlo.
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (163390 => 163391)
--- trunk/Source/_javascript_Core/ChangeLog 2014-02-04 19:09:34 UTC (rev 163390)
+++ trunk/Source/_javascript_Core/ChangeLog 2014-02-04 19:09:52 UTC (rev 163391)
@@ -1,5 +1,15 @@
2014-02-04 Mark Hahnenberg <[email protected]>
+ ASSERT in speculateMachineInt on 32-bit platforms
+ https://bugs.webkit.org/show_bug.cgi?id=128155
+
+ Reviewed by Filip Pizlo.
+
+ * dfg/DFGPredictionPropagationPhase.cpp:
+ (JSC::DFG::PredictionPropagationPhase::propagate):
+
+2014-02-04 Mark Hahnenberg <[email protected]>
+
GC timer should always do a FullCollection
https://bugs.webkit.org/show_bug.cgi?id=128186
Modified: trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp (163390 => 163391)
--- trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp 2014-02-04 19:09:34 UTC (rev 163390)
+++ trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp 2014-02-04 19:09:52 UTC (rev 163391)
@@ -135,7 +135,7 @@
case JSConstant:
case WeakJSConstant: {
SpeculatedType type = speculationFromValue(m_graph.valueOfJSConstant(node));
- if (type == SpecInt52AsDouble)
+ if (type == SpecInt52AsDouble && enableInt52())
type = SpecInt52;
changed |= setPrediction(type);
break;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
