[webkit-reviews] review granted: [Bug 69721] JSVALUE32_64 DFG JIT - Bug fix for ConvertThis : [Attachment 110314] the patch
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Sun Oct 9 19:29:08 PDT 2011
Darin Adler <darin at apple.com> has granted Yuqiang Xian
<yuqiang.xian at intel.com>'s request for review:
Bug 69721: JSVALUE32_64 DFG JIT - Bug fix for ConvertThis
https://bugs.webkit.org/show_bug.cgi?id=69721
Attachment 110314: the patch
https://bugs.webkit.org/attachment.cgi?id=110314&action=review
------- Additional Comments from Darin Adler <darin at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=110314&action=review
> Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:1762
> + ASSERT((JSValue::UndefinedTag + 1 == JSValue::NullTag) &&
(JSValue::NullTag & 0x1));
As I mentioned in the other bug, this assertion should be:
COMPILE_ASSERT((JSValue::UndefinedTag | 1) == JSValue::NullTag);
More information about the webkit-reviews
mailing list