Title: [97078] trunk/Source/_javascript_Core
- Revision
- 97078
- Author
- commit-qu...@webkit.org
- Date
- 2011-10-10 12:54:08 -0700 (Mon, 10 Oct 2011)
Log Message
JSVALUE32_64 DFG JIT - bug fix for V8 benchmark cases "crypto" and "raytrace"
https://bugs.webkit.org/show_bug.cgi?id=69748
Patch by Yuqiang Xian <yuqiang.x...@intel.com> on 2011-10-10
Reviewed by Filip Pizlo.
* dfg/DFGJITCodeGenerator32_64.cpp:
(JSC::DFG::JITCodeGenerator::cachedGetMethod):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compileObjectEquality):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (97077 => 97078)
--- trunk/Source/_javascript_Core/ChangeLog 2011-10-10 19:52:06 UTC (rev 97077)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-10-10 19:54:08 UTC (rev 97078)
@@ -1,3 +1,15 @@
+2011-10-10 Yuqiang Xian <yuqiang.x...@intel.com>
+
+ JSVALUE32_64 DFG JIT - bug fix for V8 benchmark cases "crypto" and "raytrace"
+ https://bugs.webkit.org/show_bug.cgi?id=69748
+
+ Reviewed by Filip Pizlo.
+
+ * dfg/DFGJITCodeGenerator32_64.cpp:
+ (JSC::DFG::JITCodeGenerator::cachedGetMethod):
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+
2011-10-10 Adam Roben <aro...@apple.com>
Build fix
Modified: trunk/Source/_javascript_Core/dfg/DFGJITCodeGenerator32_64.cpp (97077 => 97078)
--- trunk/Source/_javascript_Core/dfg/DFGJITCodeGenerator32_64.cpp 2011-10-10 19:52:06 UTC (rev 97077)
+++ trunk/Source/_javascript_Core/dfg/DFGJITCodeGenerator32_64.cpp 2011-10-10 19:54:08 UTC (rev 97078)
@@ -1139,6 +1139,7 @@
JITCompiler::Jump wrongProtoStructure = m_jit.branchPtrWithPatch(JITCompiler::NotEqual, JITCompiler::Address(resultPayloadGPR, JSCell::structureOffset()), protoStructToCompare, JITCompiler::TrustedImmPtr(reinterpret_cast<void*>(-1)));
putFunction = m_jit.moveWithPatch(JITCompiler::TrustedImmPtr(0), resultPayloadGPR);
+ m_jit.move(TrustedImm32(JSValue::CellTag), resultTagGPR);
JITCompiler::Jump done = m_jit.jump();
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (97077 => 97078)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2011-10-10 19:52:06 UTC (rev 97077)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2011-10-10 19:54:08 UTC (rev 97078)
@@ -352,7 +352,7 @@
SpeculateCellOperand op1(this, node.child1());
SpeculateCellOperand op2(this, node.child2());
GPRTemporary resultTag(this, op1);
- GPRTemporary resultPayload(this, op1);
+ GPRTemporary resultPayload(this, op2);
GPRReg op1GPR = op1.gpr();
GPRReg op2GPR = op2.gpr();
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
