Merge remote-tracking branch 'origin/stable' into dev

Change-Id: Ibe8c6167bf9d9b6bd689b93ed7f5b94cdbd73ba7

1 files changed, 11 insertions, 3 deletions

diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index 1ba40def3..b98d824f5 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -317,8 +317,8 @@ private:
                 && node.canSpeculateInteger()) {
                 if (isX86())
                     break;
-                fixDoubleEdge(0);
-                fixDoubleEdge(1);
+                injectInt32ToDoubleNode(0);
+                injectInt32ToDoubleNode(1);
                 
                 Node& oldDivision = m_graph[m_compileIndex];
                 
@@ -540,11 +540,19 @@ private:
         Node& source = m_graph[m_compileIndex];
         Edge& edge = m_graph.child(source, childIndex);
         
-        if (!m_graph[edge].shouldSpeculateInteger()) {
+        if (m_graph[edge].prediction() & SpecDouble) {
             edge.setUseKind(DoubleUse);
             return;
         }
         
+        injectInt32ToDoubleNode(childIndex);
+    }
+
+    void injectInt32ToDoubleNode(unsigned childIndex)
+    {
+        Node& source = m_graph[m_compileIndex];
+        Edge& edge = m_graph.child(source, childIndex);
+        
         NodeIndex resultIndex = (NodeIndex)m_graph.size();
         
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)