REGRESSION(FTL merge): Assertion fail on 32 bit with enabled DFG JIT
authormsaboff@apple.com <msaboff@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 7 Aug 2013 16:17:33 +0000 (16:17 +0000)
committermsaboff@apple.com <msaboff@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 7 Aug 2013 16:17:33 +0000 (16:17 +0000)
commiteae370db18699c9ef8581c9bfe76533673e01c5d
tree219e00d966d0874dc62cc634db144781a19b3f95
parent72a3e076c7a33e4bc1194ea49dff7b04bd8e2a3e
REGRESSION(FTL merge): Assertion fail on 32 bit with enabled DFG JIT
https://bugs.webkit.org/show_bug.cgi?id=119405

Reviewed by Geoffrey Garen.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetByValOnString): For X86 32 bit, construct an indexed address
ourselves to save a register and then load from it.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@153789 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp