Title: [111273] trunk/Source/_javascript_Core
- Revision
- 111273
- Author
- [email protected]
- Date
- 2012-03-19 16:59:12 -0700 (Mon, 19 Mar 2012)
Log Message
DFG can no longer compile V8-v4/regexp in debug mode
https://bugs.webkit.org/show_bug.cgi?id=81592
Reviewed by Gavin Barraclough.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (111272 => 111273)
--- trunk/Source/_javascript_Core/ChangeLog 2012-03-19 23:59:07 UTC (rev 111272)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-03-19 23:59:12 UTC (rev 111273)
@@ -1,5 +1,17 @@
2012-03-19 Filip Pizlo <[email protected]>
+ DFG can no longer compile V8-v4/regexp in debug mode
+ https://bugs.webkit.org/show_bug.cgi?id=81592
+
+ Reviewed by Gavin Barraclough.
+
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+
+2012-03-19 Filip Pizlo <[email protected]>
+
Prediction propagation for UInt32ToNumber incorrectly assumes that outs outcome does not
change throughout the fixpoint
https://bugs.webkit.org/show_bug.cgi?id=81583
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (111272 => 111273)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2012-03-19 23:59:07 UTC (rev 111272)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2012-03-19 23:59:12 UTC (rev 111273)
@@ -2529,7 +2529,9 @@
GPRResult result(this);
callOperation(operationRegExpTest, result.gpr(), baseGPR, argumentGPR);
- noResult(m_compileIndex);
+ // Must use jsValueResult because otherwise we screw up register
+ // allocation, which thinks that this node has a result.
+ booleanResult(result.gpr(), m_compileIndex);
break;
}
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (111272 => 111273)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2012-03-19 23:59:07 UTC (rev 111272)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2012-03-19 23:59:12 UTC (rev 111273)
@@ -2562,7 +2562,6 @@
case RegExpExec: {
if (compileRegExpExec(node))
return;
-
if (!node.adjustedRefCount()) {
SpeculateCellOperand base(this, node.child1());
SpeculateCellOperand argument(this, node.child2());
@@ -2573,7 +2572,9 @@
GPRResult result(this);
callOperation(operationRegExpTest, result.gpr(), baseGPR, argumentGPR);
- noResult(m_compileIndex);
+ // Must use jsValueResult because otherwise we screw up register
+ // allocation, which thinks that this node has a result.
+ jsValueResult(result.gpr(), m_compileIndex);
break;
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
