Fix wrong edge type from get-by-val in 32 bits
Created attachment 440079 [details] Patch
Comment on attachment 440079 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=440079&action=review > Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:4518 > + JSValueOperand baseOperand(this, baseEdge); > + generate(baseOperand.gpr()); base is JSValue, but it only passes payload part of JSValue. In 32bit, there is tag part, which needs to be passed. If it is a JSValue, then we need to use JSValueRegs.
Created attachment 440260 [details] Patch
Comment on attachment 440260 [details] Patch r=me
Committed r283603 (242555@main): <https://commits.webkit.org/242555@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 440260 [details].
<rdar://problem/83921689>