X-Git-Url: http://git.webkit.org/?p=WebKit-https.git;a=blobdiff_plain;f=Source%2FJavaScriptCore%2Fdfg%2FDFGFixupPhase.cpp;h=ab1c539b2e2cda667b4e9bab90362724037b282b;hp=5c356aba19113366f60968c371388c8db35acf32;hb=f272943eabf1b0e43db9e5d7e3db3433e07e31f2;hpb=606f8c70e8e1919f982f6798393d5140a32cbc4d

diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index 5c356ab..ab1c539 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -126,8 +126,11 @@ private:
         }
 
         case ArithClz32: {
-            fixIntConvertingEdge(node->child1());
-            node->setArithMode(Arith::Unchecked);
+            if (node->child1()->shouldSpeculateNotCell()) {
+                fixIntConvertingEdge(node->child1());
+                node->clearFlags(NodeMustGenerate);
+            } else
+                fixEdge<UntypedUse>(node->child1());
             break;
         }