diff options
| author | Michael Saboff <msaboff@apple.com> | 2014-09-29 16:56:20 +0200 |
|---|---|---|
| committer | Allan Sandfeld Jensen <allan.jensen@digia.com> | 2014-09-30 11:21:10 +0200 |
| commit | 3a65cdfd6a28193937b338d6cc74be20c3f8d25b (patch) | |
| tree | 01c0b49ba995088a341e219cfbcd322ee7ca19cf /Source/JavaScriptCore/runtime/JSArray.cpp | |
| parent | eb47b1aa47a873821c5d4a5e3b6b69589da8000b (diff) | |
| download | qtwebkit-3a65cdfd6a28193937b338d6cc74be20c3f8d25b.tar.gz | |
DFG 32Bit: Crash loading "Classic" site @ translate.google.com
https://bugs.webkit.org/show_bug.cgi?id=120015
Reviewed by Sam Weinig.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateCell): Added checks for spillFormat being
DataFormatInteger or DataFormatDouble similar to what is in the 64 bit code and in
all versions of fillSpeculateBoolean().
Change-Id: I4de21707f00c1538b82b9bee6b2acc2903611983
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Diffstat (limited to 'Source/JavaScriptCore/runtime/JSArray.cpp')
0 files changed, 0 insertions, 0 deletions