We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
https://bugs.webkit.org/show_bug.cgi?id=179562
<rdar://problem/35467022>
Reviewed by Saam Barati.
JSTests:
* regress-179562.js: Added.
Source/JavaScriptCore:
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGOperations.cpp:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::SafeToExecuteEdge::operator()):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::speculateNotSymbol):
(JSC::DFG::SpeculativeJIT::speculate):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGUseKind.cpp:
(WTF::printInternal):
* dfg/DFGUseKind.h:
(JSC::DFG::typeFilterFor):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::speculate):
(JSC::FTL::DFG::LowerDFGToB3::speculateNotSymbol):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@224735 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/dfg/DFGUseKind.cpp b/Source/JavaScriptCore/dfg/DFGUseKind.cpp
index 23d0db0..bd9419f 100644
--- a/Source/JavaScriptCore/dfg/DFGUseKind.cpp
+++ b/Source/JavaScriptCore/dfg/DFGUseKind.cpp
@@ -145,6 +145,9 @@
case NotStringVarUse:
out.print("NotStringVar");
return;
+ case NotSymbolUse:
+ out.print("NotSymbol");
+ return;
case NotCellUse:
out.print("NotCell");
return;
