commit 7ea4e91c49bd19d862a5366a9ae915aa822fd040
author sbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Tue Oct 04 09:19:48 2016 +0000
committer sbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Tue Oct 04 09:19:48 2016 +0000
tree 8b796f887759b2cae5a6da351b342b488f2b761d
parent e828e6509da8e282b381a16cb028ad1e4ea7abcf

Follow up fix to GetMapBucket and MapHash speculating on child node types.
To fix this, on 32-bit platforms, we do not speculate on the child
type since we just call into C code for these nodes.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@206767 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index 9e1f630..8001911 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -1588,6 +1588,7 @@
             else
                 RELEASE_ASSERT_NOT_REACHED();
 
+#if USE(JSVALUE64)
             if (node->child2()->shouldSpeculateBoolean())
                 fixEdge<BooleanUse>(node->child2());
             else if (node->child2()->shouldSpeculateInt32())
@@ -1602,6 +1603,9 @@
                 fixEdge<CellUse>(node->child2());
             else
                 fixEdge<UntypedUse>(node->child2());
+#else
+            fixEdge<UntypedUse>(node->child2());
+#endif // USE(JSVALUE64)
 
             fixEdge<Int32Use>(node->child3());
             break;
@@ -1615,6 +1619,7 @@
             break;
 
         case MapHash: {
+#if USE(JSVALUE64)
             if (node->child1()->shouldSpeculateBoolean()) {
                 fixEdge<BooleanUse>(node->child1());
                 break;
@@ -1646,6 +1651,9 @@
             }
 
             fixEdge<UntypedUse>(node->child1());
+#else
+            fixEdge<UntypedUse>(node->child1());
+#endif // USE(JSVALUE64)
             break;
         }