-
oliver@apple.com authored
https://bugs.webkit.org/show_bug.cgi?id=90127 Reviewed by Filip Pizlo. The 32-bit version of fillSpeculateDouble doesn't handle Number->fpr loads correctly. This patch fixes this by killing the fill info in the GenerationInfo when the spillFormat doesn't guarantee the value is a double. * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::fillSpeculateDouble): git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121466 268f45cc-cd09-0410-ab3c-d52691b4dbfc
41383bc5