[Webkit-unassigned] [Bug 69721] JSVALUE32_64 DFG JIT - Bug fix for ConvertThis

Sun Oct 9 19:29:08 PDT 2011

https://bugs.webkit.org/show_bug.cgi?id=69721

Darin Adler <darin at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #110314|review?, commit-queue?      |review+, commit-queue-
               Flag|                            |

--- Comment #4 from Darin Adler <darin at apple.com>  2011-10-09 19:29:08 PST ---
(From update of attachment 110314)
View in context: https://bugs.webkit.org/attachment.cgi?id=110314&action=review

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:1762
> +            ASSERT((JSValue::UndefinedTag + 1 == JSValue::NullTag) && (JSValue::NullTag & 0x1));

As I mentioned in the other bug, this assertion should be:

    COMPILE_ASSERT((JSValue::UndefinedTag | 1) == JSValue::NullTag);

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.