JSVALUE32_64 should be able to perform division on ARM without crashing, and variables
forced double should not be scrambled when performing OSR entry
https://bugs.webkit.org/show_bug.cgi?id=84272
Reviewed by Geoff Garen.
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGOSREntry.cpp:
(JSC::DFG::prepareOSREntry):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@114570 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index c0ab117..9a08911 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -250,7 +250,6 @@
case ArithMin:
case ArithMax:
case ArithMul:
- case ArithDiv:
case ArithMod: {
if (Node::shouldSpeculateInteger(m_graph[node.child1()], m_graph[node.child2()])
&& node.canSpeculateInteger())
@@ -260,6 +259,16 @@
break;
}
+ case ArithDiv: {
+ if (isX86()
+ && Node::shouldSpeculateInteger(m_graph[node.child1()], m_graph[node.child2()])
+ && node.canSpeculateInteger())
+ break;
+ fixDoubleEdge(0);
+ fixDoubleEdge(1);
+ break;
+ }
+
case ArithAbs: {
if (m_graph[node.child1()].shouldSpeculateInteger()
&& node.canSpeculateInteger())
