commit 9c7addf07474fa7ce536bfd3c9500fd72f409b76
author fpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Thu Mar 08 10:01:32 2012 +0000
committer fpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Thu Mar 08 10:01:32 2012 +0000
tree 85f8be373e2c5f73ad5067f8a52c66fe31891fee
parent 52856ee66765a3c8d373fa820ca28902dfd54b75

DFG CFA incorrectly handles ValueToInt32
https://bugs.webkit.org/show_bug.cgi?id=80568

Reviewed by Gavin Barraclough.
        
Changed it match exactly the decision pattern used in
DFG::SpeculativeJIT::compileValueToInt32

* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@110159 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/dfg/DFGAbstractState.cpp

diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
index 38af844..7ab05f3 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
@@ -291,12 +291,12 @@
         break;
             
     case ValueToInt32:
-        if (!m_graph[node.child1()].shouldNotSpeculateInteger()) {
+        if (m_graph[node.child1()].shouldNotSpeculateInteger()) {
             if (m_graph[node.child1()].shouldSpeculateDouble())
                 forNode(node.child1()).filter(PredictNumber);
-            else
-                forNode(node.child1()).filter(PredictInt32);
-        }
+        } else
+            forNode(node.child1()).filter(PredictInt32);
+        
         forNode(nodeIndex).set(PredictInt32);
         break;