Unreviewed, rolling out r204697
[WebKit-https.git] / Source / JavaScriptCore / dfg / DFGFixupPhase.cpp
index 948a57e..3bb156b 100644 (file)
@@ -1459,23 +1459,12 @@ private:
             RefPtr<TypeSet> typeSet = node->typeLocation()->m_instructionTypeSet;
             RuntimeTypeMask seenTypes = typeSet->seenTypes();
             if (typeSet->doesTypeConformTo(TypeAnyInt)) {
-                if (node->child1()->shouldSpeculateInt32()) {
+                if (node->child1()->shouldSpeculateInt32())
                     fixEdge<Int32Use>(node->child1());
-                    node->remove();
-                    break;
-                }
-
-                if (enableInt52()) {
+                else
                     fixEdge<AnyIntUse>(node->child1());
-                    node->remove();
-                    break;
-                }
-
-                // Must not perform fixEdge<NumberUse> here since the type set only includes TypeAnyInt. Double values should be logged.
-            }
-
-            if (typeSet->doesTypeConformTo(TypeNumber | TypeAnyInt) && ((seenTypes & TypeNumber) && (seenTypes & TypeAnyInt))) {
-                // NumberUse can pass TypeNumber and TypeAnyInt. Thus, this node removal is allowed only if both TypeNumber and TypeAnyInt are logged in the type set.
+                node->remove();
+            } else if (typeSet->doesTypeConformTo(TypeNumber | TypeAnyInt)) {
                 fixEdge<NumberUse>(node->child1());
                 node->remove();
             } else if (typeSet->doesTypeConformTo(TypeString)) {