| commit | a7f7dcdf9f0ee713db511a50222a46061e776f65 | [log] [tgz] |
|---|---|---|
| author | fpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> | Tue Jul 24 19:47:18 2012 +0000 |
| committer | fpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> | Tue Jul 24 19:47:18 2012 +0000 |
| tree | 542c422d497078dc37fe2846c8b0151cdda74812 | |
| parent | ce08116c4941012fe4e536d4471db65ca311fa6a [diff] |
REGRESSION(r123417): It made tests assert/crash on 32 bit https://bugs.webkit.org/show_bug.cgi?id=92088 Reviewed by Mark Hahnenberg. The pointer arithmetic was wrong, because negative numbers are hard to think about. * dfg/DFGRepatch.cpp: (JSC::DFG::emitPutTransitionStub): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage): git-svn-id: http://svn.webkit.org/repository/webkit/trunk@123510 268f45cc-cd09-0410-ab3c-d52691b4dbfc