Bug 69549

Summary:	DFG JIT 32_64 should check type of values being filled by fillSpeculateInt
Product:	WebKit	Reporter:	Gavin Barraclough <barraclough>
Component:	JavaScriptCore	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED FIXED
Severity:	Normal
Priority:	P2
Version:	528+ (Nightly build)
Hardware:	Unspecified
OS:	Unspecified

Gavin Barraclough

Reported 2011-10-06 11:58:31 PDT

This breaks sunspider/3d-cube.

Attachments
Add attachment proposed patch, testcase, etc.

Gavin Barraclough

Comment 1 2011-10-06 11:59:57 PDT

Fixed in r96841

Note You need to log in before you can comment on or make changes to this bug.