[JSC] Make ArithClz32 work with Cell arguments

[WebKit-https.git] / Source / JavaScriptCore / dfg / DFGFixupPhase.cpp

diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index 5c356ab..ab1c539 100644 (file)
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -126,8 +126,11 @@ private:
         }
 
         case ArithClz32: {
-            fixIntConvertingEdge(node->child1());
-            node->setArithMode(Arith::Unchecked);
+            if (node->child1()->shouldSpeculateNotCell()) {
+                fixIntConvertingEdge(node->child1());
+                node->clearFlags(NodeMustGenerate);
+            } else
+                fixEdge<UntypedUse>(node->child1());
             break;
         }