-
fpizlo@apple.com authored
https://bugs.webkit.org/show_bug.cgi?id=110184 Reviewed by Zoltan Herczeg. 32-bit backend was making all sorts of crazy assumptions, which happened to mostly not break things prior to http://trac.webkit.org/changeset/143241. This brings the 32-bit backend's type speculation fully into compliance with what the 64-bit backend does. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32): (JSC::DFG::SpeculativeJIT::compileValueToInt32): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): (JSC::DFG::SpeculativeJIT::fillSpeculateDouble): (JSC::DFG::SpeculativeJIT::fillSpeculateCell): (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143314 268f45cc-cd09-0410-ab3c-d52691b4dbfc
b0344dc4