diff options
Diffstat (limited to 'Source/JavaScriptCore/dfg/DFGFixupPhase.cpp')
-rw-r--r-- | Source/JavaScriptCore/dfg/DFGFixupPhase.cpp | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp index 64d7f63c9..c8dd0cb3f 100644 --- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp +++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp @@ -1369,12 +1369,22 @@ private: RefPtr<TypeSet> typeSet = node->typeLocation()->m_instructionTypeSet; RuntimeTypeMask seenTypes = typeSet->seenTypes(); if (typeSet->doesTypeConformTo(TypeMachineInt)) { - if (node->child1()->shouldSpeculateInt32()) + if (node->child1()->shouldSpeculateInt32()) { fixEdge<Int32Use>(node->child1()); - else + node->remove(); + break; + } + + if (enableInt52()) { fixEdge<MachineIntUse>(node->child1()); - node->remove(); - } else if (typeSet->doesTypeConformTo(TypeNumber | TypeMachineInt)) { + node->remove(); + break; + } + + // Must not perform fixEdge<NumberUse> here since the type set only includes TypeMachineInt. Double values should be logged. + } + + if (typeSet->doesTypeConformTo(TypeNumber | TypeMachineInt)) { fixEdge<NumberUse>(node->child1()); node->remove(); } else if (typeSet->doesTypeConformTo(TypeString)) { |