diff options
| author | Michael Saboff <msaboff@apple.com> | 2013-04-04 13:58:00 +0200 |
|---|---|---|
| committer | The Qt Project <gerrit-noreply@qt-project.org> | 2013-04-04 14:56:19 +0200 |
| commit | 4fa26ee918729063f9b731d801064b22ae7d8fd9 (patch) | |
| tree | 5edb18566dd6537840713683be927a17c2fbf4cb /Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp | |
| parent | d549f4b4ab324e2d4871db8cbf83c27af4ba7866 (diff) | |
Change set r140201 broke editing/selection/move-by-word-visually-multi-line.html
https://bugs.webkit.org/show_bug.cgi?id=107340
Reviewed by Filip Pizlo.
Due to the change landed in r140201, more nodes might end up
generating Int32ToDouble nodes. Therefore, changed the JSVALUE64
constant path of compileInt32ToDouble() to use the more
restrictive isInt32Constant() check on the input. This check was
the same as the existing ASSERT() so the ASSERT was eliminated.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
Change-Id: I8e9f3858414e37f5b8232a58d8f6f9dada755343
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140221 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Diffstat (limited to 'Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp')
| -rw-r--r-- | Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp index 96a994059..4f2889b8f 100644 --- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp +++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp @@ -2250,8 +2250,7 @@ void SpeculativeJIT::compileInt32ToDouble(Node& node) // than a int->double conversion. On 32_64, unfortunately, we currently don't have // any such mechanism - though we could have it, if we just provisioned some memory // in CodeBlock for the double form of integer constants. - if (at(node.child1()).hasConstant()) { - ASSERT(isInt32Constant(node.child1().index())); + if (isInt32Constant(node.child1().index())) { FPRTemporary result(this); GPRTemporary temp(this); m_jit.move(MacroAssembler::Imm64(reinterpretDoubleToInt64(valueOfNumberConstant(node.child1().index()))), temp.gpr()); |