Title: [126928] trunk/Source/_javascript_Core
- Revision
- 126928
- Author
- [email protected]
- Date
- 2012-08-28 14:21:22 -0700 (Tue, 28 Aug 2012)
Log Message
PutById uses DataLabel32, not DataLabelCompact
https://bugs.webkit.org/show_bug.cgi?id=95245
Reviewed by Geoff Garen.
JIT::resetPatchPutById calls the the wrong thing on x86-64 – this is moot right now,
since they currently both do the same thing, but if we were to ever make compact mean
8-bit this could be a real problem. Also, don't rely on the object still being in eax
on entry to the transition stub – this isn't very robust.
* jit/JITPropertyAccess.cpp:
(JSC::JIT::privateCompilePutByIdTransition):
- DataLabelCompact -> DataLabel32
(JSC::JIT::resetPatchPutById):
- reload regT0 from the stack
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (126927 => 126928)
--- trunk/Source/_javascript_Core/ChangeLog 2012-08-28 21:02:13 UTC (rev 126927)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-08-28 21:21:22 UTC (rev 126928)
@@ -1,3 +1,21 @@
+2012-08-28 Gavin Barraclough <[email protected]>
+
+ PutById uses DataLabel32, not DataLabelCompact
+ https://bugs.webkit.org/show_bug.cgi?id=95245
+
+ Reviewed by Geoff Garen.
+
+ JIT::resetPatchPutById calls the the wrong thing on x86-64 – this is moot right now,
+ since they currently both do the same thing, but if we were to ever make compact mean
+ 8-bit this could be a real problem. Also, don't rely on the object still being in eax
+ on entry to the transition stub – this isn't very robust.
+
+ * jit/JITPropertyAccess.cpp:
+ (JSC::JIT::privateCompilePutByIdTransition):
+ - DataLabelCompact -> DataLabel32
+ (JSC::JIT::resetPatchPutById):
+ - reload regT0 from the stack
+
2012-08-28 Sheriff Bot <[email protected]>
Unreviewed, rolling out r126914.
Modified: trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp (126927 => 126928)
--- trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp 2012-08-28 21:02:13 UTC (rev 126927)
+++ trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp 2012-08-28 21:21:22 UTC (rev 126928)
@@ -537,6 +537,8 @@
void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, PropertyOffset cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress, bool direct)
{
+ peek(regT0, JITSTACKFRAME_ARGS_INDEX);
+
JumpList failureCases;
// Check eax is an object of the right Structure.
failureCases.append(emitJumpIfNotJSCell(regT0));
@@ -1162,7 +1164,7 @@
else
repatchBuffer.relink(stubInfo->callReturnLocation, cti_op_put_by_id);
repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(stubInfo->patch.baseline.u.put.structureToCompare), reinterpret_cast<void*>(-1));
- repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelCompactAtOffset(stubInfo->patch.baseline.u.put.displacementLabel), 0);
+ repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(stubInfo->patch.baseline.u.put.displacementLabel), 0);
}
#endif // USE(JSVALUE64)
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
