REGRESSION(r144131): It made fast/js/regress/string-repeat-arith.html assert on 32 bit

https://bugs.webkit.org/show_bug.cgi?id=112106

Rubber stamped by Filip Pizlo.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32): Get rid of the case for constants because
we would have done constant folding anyways on a ValueToInt32.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): Fixed a random compile error with this flag enabled.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146945 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/ChangeLog

+2013-03-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        REGRESSION(r144131): It made fast/js/regress/string-repeat-arith.html assert on 32 bit
+        https://bugs.webkit.org/show_bug.cgi?id=112106
+
+        Rubber stamped by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32): Get rid of the case for constants because
+        we would have done constant folding anyways on a ValueToInt32.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): Fixed a random compile error with this flag enabled.
+
 2013-03-26  Filip Pizlo  <fpizlo@apple.com>
         JSC_enableProfiler=true should also cause JSGlobalData to save the profiler output somewhere

Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -2096,22 +2096,6 @@ GeneratedOperandType SpeculativeJIT::checkGeneratedTypeForToInt32(Node* node)
     VirtualRegister virtualRegister = node->virtualRegister();
     GenerationInfo& info = m_generationInfo[virtualRegister];
 
-    if (info.registerFormat() == DataFormatNone) {
-        if (node->hasConstant()) {
-            if (isInt32Constant(node))
-                return GeneratedOperandInteger;
-
-            if (isNumberConstant(node))
-                return GeneratedOperandDouble;
-
-            terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
-            return GeneratedOperandTypeUnknown;
-        }
-
-        if (info.spillFormat() == DataFormatDouble)
-            return GeneratedOperandDouble;
-    }
-
     switch (info.registerFormat()) {
     case DataFormatStorage:
         RELEASE_ASSERT_NOT_REACHED();

Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

@@ -1173,7 +1173,7 @@ GPRReg SpeculativeJIT::fillSpeculateCell(Edge edge)
 GPRReg SpeculativeJIT::fillSpeculateBoolean(Edge edge)
 {
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    dataLogF("SpecBool@%d   ", node->index());
+    dataLogF("SpecBool@%d   ", edge.node()->index());
 #endif
     AbstractValue& value = m_state.forNode(edge);
     SpeculatedType type = value.m_type;