Changeset 94801 in webkit for trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

Timestamp:

Sep 8, 2011, 2:36:35 PM (14 years ago)

Author:

[email protected]

Message:

DFG speculative JIT does not initialize integer tags for PredictInt32 temporaries
​https://bugs.webkit.org/show_bug.cgi?id=67840

Reviewed by Gavin Barraclough.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::initializeVariableTypes):

File:

• trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -1432 +1432 @@
 {
     ASSERT(!m_compileIndex);
-    for (int var = 0; var < m_jit.codeBlock()->m_numVars; ++var) {
+    for (int var = 0; var < (int)m_jit.graph().predictions().numberOfVariables(); ++var) {
         if (isInt32Prediction(m_jit.graph().getPrediction(var)))
             m_jit.storePtr(GPRInfo::tagTypeNumberRegister, JITCompiler::addressFor((VirtualRegister)var));