Title: [271226] trunk/Source/_javascript_Core
- Revision
- 271226
- Author
- [email protected]
- Date
- 2021-01-06 23:52:55 -0800 (Wed, 06 Jan 2021)
Log Message
Fix a dataMemoryTempRegister use violation in FTLLowerDFGToB3's compileLoopHint().
https://bugs.webkit.org/show_bug.cgi?id=220399
Reviewed by Yusuke Suzuki.
This was tripping an assertion failure on the invalid use of the dataMemoryTempRegister
during a Debug build JSC stress test run with DoesGC validation enabled.
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileLoopHint):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (271225 => 271226)
--- trunk/Source/_javascript_Core/ChangeLog 2021-01-07 06:28:36 UTC (rev 271225)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-01-07 07:52:55 UTC (rev 271226)
@@ -1,3 +1,16 @@
+2021-01-06 Mark Lam <[email protected]>
+
+ Fix a dataMemoryTempRegister use violation in FTLLowerDFGToB3's compileLoopHint().
+ https://bugs.webkit.org/show_bug.cgi?id=220399
+
+ Reviewed by Yusuke Suzuki.
+
+ This was tripping an assertion failure on the invalid use of the dataMemoryTempRegister
+ during a Debug build JSC stress test run with DoesGC validation enabled.
+
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileLoopHint):
+
2021-01-06 Yusuke Suzuki <[email protected]>
[JSC] DateTimeFormat#formatRange should generate the same output to DateTimeFormat#format if startDate and endDate are "practically-equal"
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (271225 => 271226)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2021-01-07 06:28:36 UTC (rev 271225)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2021-01-07 07:52:55 UTC (rev 271226)
@@ -15070,7 +15070,8 @@
if (Options::validateDoesGC()) {
// We need to mock what a Return does: claims to GC.
jit.move(CCallHelpers::TrustedImmPtr(vm->heap.addressOfDoesGC()), GPRInfo::regT0);
- jit.store32(CCallHelpers::TrustedImm32(DoesGCCheck::encode(true, DoesGCCheck::Special::Uninitialized)), CCallHelpers::Address(GPRInfo::regT0));
+ jit.move(CCallHelpers::TrustedImm32(DoesGCCheck::encode(true, DoesGCCheck::Special::Uninitialized)), GPRInfo::regT1);
+ jit.store32(GPRInfo::regT1, CCallHelpers::Address(GPRInfo::regT0));
}
}
restore();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
