Title: [149943] branches/dfgFourthTier/Source/_javascript_Core
- Revision
- 149943
- Author
- [email protected]
- Date
- 2013-05-11 16:26:30 -0700 (Sat, 11 May 2013)
Log Message
SpeculativeJIT::checkArray should use the correct ExitKind
https://bugs.webkit.org/show_bug.cgi?id=115943
Currently it uses Uncountable, which gives us no information if we end up exiting due to a
mismatched ClassInfo pointer. It should instead use BadType and should pass the correct
JSValueSource and Node instead of passing empty values.
Reviewed by Filip Pizlo.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::checkArray):
Modified Paths
Diff
Modified: branches/dfgFourthTier/Source/_javascript_Core/ChangeLog (149942 => 149943)
--- branches/dfgFourthTier/Source/_javascript_Core/ChangeLog 2013-05-11 21:42:44 UTC (rev 149942)
+++ branches/dfgFourthTier/Source/_javascript_Core/ChangeLog 2013-05-11 23:26:30 UTC (rev 149943)
@@ -1,3 +1,17 @@
+2013-05-10 Mark Hahnenberg <[email protected]>
+
+ SpeculativeJIT::checkArray should use the correct ExitKind
+ https://bugs.webkit.org/show_bug.cgi?id=115943
+
+ Currently it uses Uncountable, which gives us no information if we end up exiting due to a
+ mismatched ClassInfo pointer. It should instead use BadType and should pass the correct
+ JSValueSource and Node instead of passing empty values.
+
+ Reviewed by Filip Pizlo.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::checkArray):
+
2013-05-11 Filip Pizlo <[email protected]>
fourthTier: FTL should support Jump and ForceOSRExit
@@ -31,6 +45,7 @@
* runtime/Options.h:
(JSC):
+>>>>>>> .r149942
2013-05-10 Filip Pizlo <[email protected]>
fourthTier: FTL should support CompareStrictEqConstant
Modified: branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (149942 => 149943)
--- branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-05-11 21:42:44 UTC (rev 149942)
+++ branches/dfgFourthTier/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-05-11 23:26:30 UTC (rev 149943)
@@ -744,7 +744,7 @@
m_jit.loadPtr(
MacroAssembler::Address(baseReg, JSCell::structureOffset()), temp.gpr());
speculationCheck(
- Uncountable, JSValueRegs(), 0,
+ BadType, JSValueRegs(baseReg), node,
m_jit.branchPtr(
MacroAssembler::NotEqual,
MacroAssembler::Address(temp.gpr(), Structure::classInfoOffset()),
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
