32bit DFG incorrectly claims an fpr is fillable even if it has not been proven double
authoroliver@apple.com <oliver@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 28 Jun 2012 20:54:06 +0000 (20:54 +0000)
committeroliver@apple.com <oliver@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 28 Jun 2012 20:54:06 +0000 (20:54 +0000)
commit05b44a80b04ad1dfa9bd6cbdbf2d1c133fc4abf6
tree9677514efe87404c838bd7ae946464204390de39
parente6863536bb3f8da6070a3b551b50cb99cde4b141
32bit DFG incorrectly claims an fpr is fillable even if it has not been proven double
https://bugs.webkit.org/show_bug.cgi?id=90127

Reviewed by Filip Pizlo.

The 32-bit version of fillSpeculateDouble doesn't handle Number->fpr loads
correctly.  This patch fixes this by killing the fill info in the GenerationInfo
when the spillFormat doesn't guarantee the value is a double.

* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@121466 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp