Title: [181998] trunk/Source/_javascript_Core
- Revision
- 181998
- Author
- [email protected]
- Date
- 2015-03-25 21:52:14 -0700 (Wed, 25 Mar 2015)
Log Message
Unreviewed, VC found a bug. This fixes the bug.
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (181997 => 181998)
--- trunk/Source/_javascript_Core/ChangeLog 2015-03-26 04:50:28 UTC (rev 181997)
+++ trunk/Source/_javascript_Core/ChangeLog 2015-03-26 04:52:14 UTC (rev 181998)
@@ -1,5 +1,12 @@
2015-03-25 Filip Pizlo <[email protected]>
+ Unreviewed, VC found a bug. This fixes the bug.
+
+ * dfg/DFGConstantFoldingPhase.cpp:
+ (JSC::DFG::ConstantFoldingPhase::foldConstants):
+
+2015-03-25 Filip Pizlo <[email protected]>
+
Unreviewed, try to fix Windows build.
* runtime/ClonedArguments.cpp:
Modified: trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp (181997 => 181998)
--- trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp 2015-03-26 04:50:28 UTC (rev 181997)
+++ trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp 2015-03-26 04:52:14 UTC (rev 181998)
@@ -220,10 +220,10 @@
// GetMyArgumentByVal in such statically-out-of-bounds accesses; we just lose CFA unless
// GCSE removes the access entirely.
if (inlineCallFrame) {
- if (index.isUInt32() >= inlineCallFrame->arguments.size() - 1)
+ if (index.asUInt32() >= inlineCallFrame->arguments.size() - 1)
break;
} else {
- if (index.isUInt32() >= m_state.variables().numberOfArguments() - 1)
+ if (index.asUInt32() >= m_state.variables().numberOfArguments() - 1)
break;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
