commit b5e71417d8b845959f00d8392916f23183620d0f
author fpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Mon Aug 20 22:32:18 2012 +0000
committer fpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Mon Aug 20 22:32:18 2012 +0000
tree b3e97916dddc7be6369a56dcc8c6316a8dd91798
parent af87202c7b030a36fc9e733bcd444f9f663cde0b

fast/js/dfg-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html crashes on 32-bit
https://bugs.webkit.org/show_bug.cgi?id=94026

Reviewed by Mark Hahnenberg.

* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126081 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/ChangeLog

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 64604f6..9b481e6 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,13 @@
+2012-08-20  Filip Pizlo  <fpizlo@apple.com>
+
+        fast/js/dfg-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html crashes on 32-bit
+        https://bugs.webkit.org/show_bug.cgi?id=94026
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+
 2012-08-19  Filip Pizlo  <fpizlo@apple.com>
 
         The relationship between abstract values and structure transition watchpoints should be rationalized