commit a7f7dcdf9f0ee713db511a50222a46061e776f65
author fpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Tue Jul 24 19:47:18 2012 +0000
committer fpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Tue Jul 24 19:47:18 2012 +0000
tree 542c422d497078dc37fe2846c8b0151cdda74812
parent ce08116c4941012fe4e536d4471db65ca311fa6a

REGRESSION(r123417): It made tests assert/crash on 32 bit
https://bugs.webkit.org/show_bug.cgi?id=92088

Reviewed by Mark Hahnenberg.

The pointer arithmetic was wrong, because negative numbers are hard to think about.

* dfg/DFGRepatch.cpp:
(JSC::DFG::emitPutTransitionStub):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@123510 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/ChangeLog

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index f463bd2..60265bb 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,17 @@
+2012-07-24  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r123417): It made tests assert/crash on 32 bit
+        https://bugs.webkit.org/show_bug.cgi?id=92088
+
+        Reviewed by Mark Hahnenberg.
+
+        The pointer arithmetic was wrong, because negative numbers are hard to think about.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::emitPutTransitionStub):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+
 2012-07-24  Patrick Gansterer  <paroga@webkit.org>
 
         Store the full year in GregorianDateTime