Changeset 229545 in webkit

Timestamp:

Mar 12, 2018 1:19:53 PM (6 years ago)

Author:

fpizlo@apple.com

Message:

Unreviewed, fix simple goof that was causing 32-bit DFG crashes.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-03-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix simple goof that was causing 32-bit DFG crashes.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
+
 2018-03-11  Yusuke Suzuki  <utatane.tea@gmail.com>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -7007 +7007 @@
 
     if (isX86() && is32Bit() && !lengthIsKnown) {
-        GPRFlushedCallResult result(this);
+        GPRFlushedCallResult realResult(this);
+        result.adopt(realResult);
         resultGPR = result.gpr();
         RELEASE_ASSERT(resultGPR == GPRInfo::regT0);