Title: [102200] trunk/Source/_javascript_Core
- Revision
- 102200
- Author
- [email protected]
- Date
- 2011-12-06 17:29:47 -0800 (Tue, 06 Dec 2011)
Log Message
DFG 32_64 call linking does not handle non-cell callees correctly
https://bugs.webkit.org/show_bug.cgi?id=73965
Reviewed by Sam Weinig.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (102199 => 102200)
--- trunk/Source/_javascript_Core/ChangeLog 2011-12-07 01:29:05 UTC (rev 102199)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-12-07 01:29:47 UTC (rev 102200)
@@ -1,3 +1,13 @@
+2011-12-06 Filip Pizlo <[email protected]>
+
+ DFG 32_64 call linking does not handle non-cell callees correctly
+ https://bugs.webkit.org/show_bug.cgi?id=73965
+
+ Reviewed by Sam Weinig.
+
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::emitCall):
+
2011-12-06 Sam Weinig <[email protected]>
Remove unintentional type name shadowing in the Interpreter
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (102199 => 102200)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2011-12-07 01:29:05 UTC (rev 102199)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2011-12-07 01:29:47 UTC (rev 102200)
@@ -1303,9 +1303,10 @@
GPRReg resultTagGPR = resultTag.gpr();
JITCompiler::DataLabelPtr targetToCheck;
- JITCompiler::Jump slowPath;
+ JITCompiler::JumpList slowPath;
- slowPath = m_jit.branchPtrWithPatch(MacroAssembler::NotEqual, calleePayloadGPR, targetToCheck);
+ slowPath.append(m_jit.branchPtrWithPatch(MacroAssembler::NotEqual, calleePayloadGPR, targetToCheck));
+ slowPath.append(m_jit.branch32(MacroAssembler::NotEqual, calleeTagGPR, TrustedImm32(JSValue::CellTag)));
m_jit.loadPtr(MacroAssembler::Address(calleePayloadGPR, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), resultPayloadGPR);
m_jit.storePtr(resultPayloadGPR, payloadOfCallData(RegisterFile::ScopeChain));
m_jit.store32(MacroAssembler::TrustedImm32(JSValue::CellTag), tagOfCallData(RegisterFile::ScopeChain));
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
