Changeset 96980 in webkit for trunk/Source/JavaScriptCore/ChangeLog

Timestamp:

Oct 7, 2011, 1:52:56 PM (14 years ago)

Author:

[email protected]

Message:

DFG ConvertThis speculation logic is wrong
​https://bugs.webkit.org/show_bug.cgi?id=69663

Reviewed by Oliver Hunt.

• dfg/DFGPropagator.cpp:

(JSC::DFG::Propagator::fixupNode):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

File:

• trunk/Source/JavaScriptCore/ChangeLog (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-10-07  Filip Pizlo  <[email protected]>
+
+        DFG ConvertThis speculation logic is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=69663
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::fixupNode):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
 2011-10-07  Oliver Hunt  <[email protected]>