1 files changed, 10 insertions, 2 deletions
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index 556904aca..b98d824f5 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -317,8 +317,8 @@ private:
                 && node.canSpeculateInteger()) {
                 if (isX86())
                     break;
-                fixDoubleEdge(0);
-                fixDoubleEdge(1);
+                injectInt32ToDoubleNode(0);
+                injectInt32ToDoubleNode(1);
                 
                 Node& oldDivision = m_graph[m_compileIndex];
                 
@@ -545,6 +545,14 @@ private:
             return;
         }
         
+        injectInt32ToDoubleNode(childIndex);
+    }
+
+    void injectInt32ToDoubleNode(unsigned childIndex)
+    {
+        Node& source = m_graph[m_compileIndex];
+        Edge& edge = m_graph.child(source, childIndex);
+        
         NodeIndex resultIndex = (NodeIndex)m_graph.size();
         
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)