Title: [202058] trunk/Source/_javascript_Core
- Revision
- 202058
- Author
- [email protected]
- Date
- 2016-06-14 12:01:58 -0700 (Tue, 14 Jun 2016)
Log Message
REGRESSION(202002-202014): 845 32-bit JSC Stress Test failures
https://bugs.webkit.org/show_bug.cgi?id=158737
Reviewed by Filip Pizlo.
When the this child and arguments child for the varargs nodes was switched I missed one
case in the 32-bit build.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (202057 => 202058)
--- trunk/Source/_javascript_Core/ChangeLog 2016-06-14 18:59:48 UTC (rev 202057)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-06-14 19:01:58 UTC (rev 202058)
@@ -1,3 +1,16 @@
+2016-06-14 Keith Miller <[email protected]>
+
+ REGRESSION(202002-202014): 845 32-bit JSC Stress Test failures
+ https://bugs.webkit.org/show_bug.cgi?id=158737
+
+ Reviewed by Filip Pizlo.
+
+ When the this child and arguments child for the varargs nodes was switched I missed one
+ case in the 32-bit build.
+
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::emitCall):
+
2016-06-13 Gavin & Ellie Barraclough <[email protected]>
setUpStaticFunctionSlot does not handle Builtin|Accessor properties
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (202057 => 202058)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2016-06-14 18:59:48 UTC (rev 202057)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2016-06-14 19:01:58 UTC (rev 202058)
@@ -807,7 +807,7 @@
use(node->child3());
// Now set up the "this" argument.
- JSValueOperand thisArgument(this, node->child3());
+ JSValueOperand thisArgument(this, node->child2());
GPRReg thisArgumentTagGPR = thisArgument.tagGPR();
GPRReg thisArgumentPayloadGPR = thisArgument.payloadGPR();
thisArgument.use();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
