Changeset 278642 in webkit

Timestamp:

Jun 8, 2021, 7:32:47 PM (4 years ago)

Author:

rmorisset@apple.com

Message:

Fix speculated type in speculateNeitherDoubleNorHeapBigIntNorString
​https://bugs.webkit.org/show_bug.cgi?id=226786

Reviewed by Mark Lam.

I had forgotten the HeapBigInt part.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-06-08  Robin Morisset  <rmorisset@apple.com>
+
+        Fix speculated type in speculateNeitherDoubleNorHeapBigIntNorString
+        https://bugs.webkit.org/show_bug.cgi?id=226786
+
+        Reviewed by Mark Lam.
+
+        I had forgotten the HeapBigInt part.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString):
+
 2021-06-06  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -11566 +11566 @@
 void SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString(Edge edge, JSValueRegs regs, GPRReg tempGPR)
 {
-    if (!needsTypeCheck(edge, ~(SpecFullDouble | SpecString)))
+    if (!needsTypeCheck(edge, ~(SpecFullDouble | SpecString | SpecHeapBigInt)))
         return;