Title: [97393] trunk/Source/_javascript_Core
- Revision
- 97393
- Author
- [email protected]
- Date
- 2011-10-13 13:51:20 -0700 (Thu, 13 Oct 2011)
Log Message
terminateSpeculativeExecution for fillSpeculateDouble with DataFormatCell
Rubber stamped by Filip Pizlo
This is breaking fast/canvas/canvas-composite-alpha.html on 32_64 DFG JIT.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (97392 => 97393)
--- trunk/Source/_javascript_Core/ChangeLog 2011-10-13 20:48:00 UTC (rev 97392)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-10-13 20:51:20 UTC (rev 97393)
@@ -1,3 +1,16 @@
+2011-10-13 Gavin Barraclough <[email protected]>
+
+ terminateSpeculativeExecution for fillSpeculateDouble with DataFormatCell
+
+ Rubber stamped by Filip Pizlo
+
+ This is breaking fast/canvas/canvas-composite-alpha.html on 32_64 DFG JIT.
+
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+
2011-10-13 Mark Hahnenberg <[email protected]>
De-virtualized JSCell::toNumber
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (97392 => 97393)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2011-10-13 20:48:00 UTC (rev 97392)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2011-10-13 20:51:20 UTC (rev 97393)
@@ -194,12 +194,15 @@
switch (info.registerFormat()) {
case DataFormatNone:
- case DataFormatCell:
case DataFormatBoolean:
case DataFormatStorage:
// Should have filled, above.
ASSERT_NOT_REACHED();
-
+
+ case DataFormatCell:
+ terminateSpeculativeExecution();
+ return fprAllocate();
+
case DataFormatJSCell:
case DataFormatJS:
case DataFormatJSInteger:
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (97392 => 97393)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2011-10-13 20:48:00 UTC (rev 97392)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2011-10-13 20:51:20 UTC (rev 97393)
@@ -244,8 +244,11 @@
case DataFormatBoolean: // This type never occurs.
case DataFormatStorage:
ASSERT_NOT_REACHED();
-
+
case DataFormatCell:
+ terminateSpeculativeExecution();
+ return fprAllocate();
+
case DataFormatJSCell:
case DataFormatJS:
case DataFormatJSBoolean: {
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
