Title: [146945] trunk/Source/_javascript_Core
- Revision
- 146945
- Author
- mhahnenb...@apple.com
- Date
- 2013-03-26 16:45:57 -0700 (Tue, 26 Mar 2013)
Log Message
REGRESSION(r144131): It made fast/js/regress/string-repeat-arith.html assert on 32 bit
https://bugs.webkit.org/show_bug.cgi?id=112106
Rubber stamped by Filip Pizlo.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32): Get rid of the case for constants because
we would have done constant folding anyways on a ValueToInt32.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): Fixed a random compile error with this flag enabled.
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (146944 => 146945)
--- trunk/Source/_javascript_Core/ChangeLog 2013-03-26 23:01:42 UTC (rev 146944)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-03-26 23:45:57 UTC (rev 146945)
@@ -1,3 +1,16 @@
+2013-03-26 Mark Hahnenberg <mhahnenb...@apple.com>
+
+ REGRESSION(r144131): It made fast/js/regress/string-repeat-arith.html assert on 32 bit
+ https://bugs.webkit.org/show_bug.cgi?id=112106
+
+ Rubber stamped by Filip Pizlo.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32): Get rid of the case for constants because
+ we would have done constant folding anyways on a ValueToInt32.
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): Fixed a random compile error with this flag enabled.
+
2013-03-26 Filip Pizlo <fpi...@apple.com>
JSC_enableProfiler=true should also cause JSGlobalData to save the profiler output somewhere
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (146944 => 146945)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-03-26 23:01:42 UTC (rev 146944)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-03-26 23:45:57 UTC (rev 146945)
@@ -2096,22 +2096,6 @@
VirtualRegister virtualRegister = node->virtualRegister();
GenerationInfo& info = m_generationInfo[virtualRegister];
- if (info.registerFormat() == DataFormatNone) {
- if (node->hasConstant()) {
- if (isInt32Constant(node))
- return GeneratedOperandInteger;
-
- if (isNumberConstant(node))
- return GeneratedOperandDouble;
-
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- return GeneratedOperandTypeUnknown;
- }
-
- if (info.spillFormat() == DataFormatDouble)
- return GeneratedOperandDouble;
- }
-
switch (info.registerFormat()) {
case DataFormatStorage:
RELEASE_ASSERT_NOT_REACHED();
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (146944 => 146945)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2013-03-26 23:01:42 UTC (rev 146944)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2013-03-26 23:45:57 UTC (rev 146945)
@@ -1173,7 +1173,7 @@
GPRReg SpeculativeJIT::fillSpeculateBoolean(Edge edge)
{
#if DFG_ENABLE(DEBUG_VERBOSE)
- dataLogF("SpecBool@%d ", node->index());
+ dataLogF("SpecBool@%d ", edge.node()->index());
#endif
AbstractValue& value = m_state.forNode(edge);
SpeculatedType type = value.m_type;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
