[webkit-reviews] review granted: [Bug 69721] JSVALUE32_64 DFG JIT - Bug fix for ConvertThis : [Attachment 110314] the patch

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Sun Oct 9 19:29:08 PDT 2011

Darin Adler <darin at apple.com> has granted Yuqiang Xian
<yuqiang.xian at intel.com>'s request for review:
Bug 69721: JSVALUE32_64 DFG JIT - Bug fix for ConvertThis

Attachment 110314: the patch

------- Additional Comments from Darin Adler <darin at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=110314&action=review

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:1762
> +	       ASSERT((JSValue::UndefinedTag + 1 == JSValue::NullTag) &&
(JSValue::NullTag & 0x1));

As I mentioned in the other bug, this assertion should be:

    COMPILE_ASSERT((JSValue::UndefinedTag | 1) == JSValue::NullTag);

More information about the webkit-reviews mailing list