[Webkit-unassigned] [Bug 121001] [Win] Javascript crash with DFG JIT enabled.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=121001


Filip Pizlo <fpizlo at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #210972|review?, commit-queue?      |review-, commit-queue-
               Flag|                            |




--- Comment #2 from Filip Pizlo <fpizlo at apple.com>  2013-09-08 08:34:33 PST ---
(From update of attachment 210972)
View in context: https://bugs.webkit.org/attachment.cgi?id=210972&action=review

> Source/JavaScriptCore/dfg/DFGThunks.cpp:56
> +        jit.storeDouble(FPRInfo::toRegister(i), MacroAssembler::ImplicitAddress(GPRInfo::regT0));

Use Address not ImplicitAddres.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.