Apply patch. rdar://problem/109780783

Identifier: 245886.894@safari-7613.4.1.0-branch
WebKit · Jun 30, 2023 · d1a4184 · d1a4184
1 parent 4d33406
commit d1a4184
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -8401,7 +8401,7 @@ void SpeculativeJIT::compileGetTypedArrayByteOffset(Node* node)
 
 #if USE(LARGE_TYPED_ARRAYS)
     // AI promises that the result of GetTypedArrayByteOffset will be Int32, so we must uphold that promise here.
-    speculationCheck(Overflow, JSValueRegs(), nullptr, m_jit.branch32(MacroAssembler::Above, vectorGPR, TrustedImm32(std::numeric_limits<int32_t>::max())));
+    speculationCheck(Overflow, JSValueRegs(), nullptr, m_jit.branch64(MacroAssembler::Above, vectorGPR, TrustedImm32(std::numeric_limits<int32_t>::max())));
 #endif
 
     strictInt32Result(vectorGPR, node);