The lowering of Identity in the DFG backend needs to use ManualOperandSpeculation
authorsbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 23 Jun 2017 00:22:45 +0000 (00:22 +0000)
committersbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 23 Jun 2017 00:22:45 +0000 (00:22 +0000)
commit323fa2ccaf93e11bc3bdfe5341dcbaf00d6a7c46
treea718ec7216911382e620adf4574ce3a2abfc8fa6
parent3c78435c658ac26bf9ce39484614de6028dd0109
The lowering of Identity in the DFG backend needs to use ManualOperandSpeculation
https://bugs.webkit.org/show_bug.cgi?id=173743
<rdar://problem/32932536>

Reviewed by Mark Lam.

The code always manually speculates, however, we weren't specifying
ManualOperandSpeculation when creating a JSValueOperand. This would
fire an assertion in JSValueOperand construction for a node like:
Identity(String:@otherNode)

I spent about 45 minutes trying to craft a test and came up
empty. However, this fixes a debug assertion on an internal
Apple website.

* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@218729 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp