Title: [123393] trunk
- Revision
- 123393
- Author
- [email protected]
- Date
- 2012-07-23 15:38:30 -0700 (Mon, 23 Jul 2012)
Log Message
REGRESSION(r123169): It made fast/js/dfg-inline-arguments-use-from-uninlined-code.html fail on 32 bit platforms
https://bugs.webkit.org/show_bug.cgi?id=92002
Source/_javascript_Core:
Reviewed by Mark Hahnenberg.
In the process of changing the nature of local variable typing, I forgot to modify one of the places where
we glue the DFG's notion of variable prediction to the runtime's notion of variable tagging.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compile):
LayoutTests:
Unskip test that this change fixes, as requested by Ossy.
* platform/qt/Skipped:
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (123392 => 123393)
--- trunk/LayoutTests/ChangeLog 2012-07-23 22:36:43 UTC (rev 123392)
+++ trunk/LayoutTests/ChangeLog 2012-07-23 22:38:30 UTC (rev 123393)
@@ -1,3 +1,12 @@
+2012-07-23 Filip Pizlo <[email protected]>
+
+ REGRESSION(r123169): It made fast/js/dfg-inline-arguments-use-from-uninlined-code.html fail on 32 bit platforms
+ https://bugs.webkit.org/show_bug.cgi?id=92002
+
+ Unskip test that this change fixes, as requested by Ossy.
+
+ * platform/qt/Skipped:
+
2012-07-23 Andrew Wilson <[email protected]>
More unreviewed chromium expectation changes to mark tests as failing/slow.
Modified: trunk/LayoutTests/platform/qt/Skipped (123392 => 123393)
--- trunk/LayoutTests/platform/qt/Skipped 2012-07-23 22:36:43 UTC (rev 123392)
+++ trunk/LayoutTests/platform/qt/Skipped 2012-07-23 22:38:30 UTC (rev 123393)
@@ -2595,10 +2595,6 @@
# https://bugs.webkit.org/show_bug.cgi?id=91968
fast/sub-pixel/table-rows-have-stable-height.html
-# REGRESSION(r123169): It made fast/js/dfg-inline-arguments-use-from-uninlined-code.html fail on 32 bit platforms
-# https://bugs.webkit.org/show_bug.cgi?id=92002
-fast/js/dfg-inline-arguments-use-from-uninlined-code.html
-
# [Qt] svg/zoom/{page,text}/zoom-hixie-mixed-009.xml fails
# https://bugs.webkit.org/show_bug.cgi?id=92018
svg/zoom/text/zoom-hixie-mixed-009.xml
Modified: trunk/Source/_javascript_Core/ChangeLog (123392 => 123393)
--- trunk/Source/_javascript_Core/ChangeLog 2012-07-23 22:36:43 UTC (rev 123392)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-07-23 22:38:30 UTC (rev 123393)
@@ -1,3 +1,16 @@
+2012-07-23 Filip Pizlo <[email protected]>
+
+ REGRESSION(r123169): It made fast/js/dfg-inline-arguments-use-from-uninlined-code.html fail on 32 bit platforms
+ https://bugs.webkit.org/show_bug.cgi?id=92002
+
+ Reviewed by Mark Hahnenberg.
+
+ In the process of changing the nature of local variable typing, I forgot to modify one of the places where
+ we glue the DFG's notion of variable prediction to the runtime's notion of variable tagging.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+
2012-07-23 Simon Fraser <[email protected]>
Part 2 of: Implement sticky positioning
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (123392 => 123393)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2012-07-23 22:36:43 UTC (rev 123392)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2012-07-23 22:38:30 UTC (rev 123393)
@@ -1063,7 +1063,7 @@
valueSource = ValueSource(DoubleInRegisterFile);
else if (isInt32Speculation(argumentPosition.prediction()))
valueSource = ValueSource(Int32InRegisterFile);
- else if (isArraySpeculation(argumentPosition.prediction()))
+ else if (isArraySpeculation(argumentPosition.prediction()) || isCellSpeculation(argumentPosition.prediction()))
valueSource = ValueSource(CellInRegisterFile);
else if (isBooleanSpeculation(argumentPosition.prediction()))
valueSource = ValueSource(BooleanInRegisterFile);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
