Title: [278662] trunk/Source/_javascript_Core
- Revision
- 278662
- Author
- [email protected]
- Date
- 2021-06-09 09:31:25 -0700 (Wed, 09 Jun 2021)
Log Message
[JSC] Fix incorrect register reuse in 32bit after r278568
https://bugs.webkit.org/show_bug.cgi?id=226817
Patch by Xan Lopez <[email protected]> on 2021-06-09
Reviewed by Caio Araujo Neponoceno de Lima.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality):
The JSVALUE32_64 branch potentially needs both the tag and payload
registers for both left/right nodes, so we cannot reuse any of
them for the result since the first thing the code does is set it
zero. Just remove the Reuse construction.
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (278661 => 278662)
--- trunk/Source/_javascript_Core/ChangeLog 2021-06-09 16:02:23 UTC (rev 278661)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-06-09 16:31:25 UTC (rev 278662)
@@ -1,3 +1,17 @@
+2021-06-09 Xan Lopez <[email protected]>
+
+ [JSC] Fix incorrect register reuse in 32bit after r278568
+ https://bugs.webkit.org/show_bug.cgi?id=226817
+
+ Reviewed by Caio Araujo Neponoceno de Lima.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality):
+ The JSVALUE32_64 branch potentially needs both the tag and payload
+ registers for both left/right nodes, so we cannot reuse any of
+ them for the result since the first thing the code does is set it
+ zero. Just remove the Reuse construction.
+
2021-06-09 Mikhail R. Gadelha <[email protected]>
Fix inadvertent tag corruption in functionAddressOf
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (278661 => 278662)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2021-06-09 16:02:23 UTC (rev 278661)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2021-06-09 16:31:25 UTC (rev 278662)
@@ -7385,7 +7385,7 @@
#if USE(JSVALUE64)
GPRTemporary result(this, Reuse, left, right);
#else
- GPRTemporary result(this, Reuse, left, PayloadWord);
+ GPRTemporary result(this);
#endif
JSValueRegs leftRegs = left.jsValueRegs();
JSValueRegs rightRegs = right.jsValueRegs();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
