Unreviewed, fix simple goof that was causing 32-bit DFG crashes.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@229545 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Author: [email protected]

Source/JavaScriptCore/ChangeLog

@@ -1,3 +1,10 @@
+2018-03-12  Filip Pizlo  <[email protected]>
+
+        Unreviewed, fix simple goof that was causing 32-bit DFG crashes.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
+
 2018-03-11  Yusuke Suzuki  <[email protected]>
 
         [DFG] AI should convert CreateThis to NewObject if the prototype object is proved

Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -7006,7 +7006,8 @@ void SpeculativeJIT::compileCreateDirectArguments(Node* node)
     GPRTemporary length;
 
     if (isX86() && is32Bit() && !lengthIsKnown) {
-        GPRFlushedCallResult result(this);
+        GPRFlushedCallResult realResult(this);
+        result.adopt(realResult);
         resultGPR = result.gpr();
         RELEASE_ASSERT(resultGPR == GPRInfo::regT0);
         flushRegisters();