Title: [97037] trunk/Source/_javascript_Core
Revision
97037
Author
[email protected]
Date
2011-10-09 20:11:10 -0700 (Sun, 09 Oct 2011)

Log Message

JSVALUE32_64 DFG JIT - Bug fix for ConvertThis
https://bugs.webkit.org/show_bug.cgi?id=69721

Patch by Yuqiang Xian <[email protected]> on 2011-10-09
Reviewed by Darin Adler.

* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (97036 => 97037)


--- trunk/Source/_javascript_Core/ChangeLog	2011-10-10 02:29:02 UTC (rev 97036)
+++ trunk/Source/_javascript_Core/ChangeLog	2011-10-10 03:11:10 UTC (rev 97037)
@@ -1,5 +1,15 @@
 2011-10-09  Yuqiang Xian  <[email protected]>
 
+        JSVALUE32_64 DFG JIT - Bug fix for ConvertThis
+        https://bugs.webkit.org/show_bug.cgi?id=69721
+
+        Reviewed by Darin Adler.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-09  Yuqiang Xian  <[email protected]>
+
         Remove unused callOperation code of DFG JIT on X86
         https://bugs.webkit.org/show_bug.cgi?id=69722
 

Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (97036 => 97037)


--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp	2011-10-10 02:29:02 UTC (rev 97036)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp	2011-10-10 03:11:10 UTC (rev 97037)
@@ -1759,9 +1759,10 @@
             GPRReg thisValueTagGPR = thisValue.tagGPR();
             GPRReg scratchGPR = scratch.gpr();
             
+            COMPILE_ASSERT((JSValue::UndefinedTag | 1) == JSValue::NullTag, UndefinedTag_OR_1_EQUALS_NullTag);
             m_jit.move(thisValueTagGPR, scratchGPR);
-            m_jit.and32(MacroAssembler::TrustedImm32(JSValue::UndefinedTag), scratchGPR);
-            speculationCheck(m_jit.branch32(MacroAssembler::NotEqual, scratchGPR, TrustedImm32(JSValue::UndefinedTag)));
+            m_jit.or32(TrustedImm32(1), scratchGPR);
+            speculationCheck(m_jit.branch32(MacroAssembler::NotEqual, scratchGPR, TrustedImm32(JSValue::NullTag)));
             
             m_jit.move(MacroAssembler::TrustedImmPtr(m_jit.codeBlock()->globalObject()), scratchGPR);
             cellResult(scratchGPR, m_compileIndex);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes

Reply via email to