Title: [153789] trunk/Source/_javascript_Core
- Revision
- 153789
- Author
- [email protected]
- Date
- 2013-08-07 09:17:33 -0700 (Wed, 07 Aug 2013)
Log Message
REGRESSION(FTL merge): Assertion fail on 32 bit with enabled DFG JIT
https://bugs.webkit.org/show_bug.cgi?id=119405
Reviewed by Geoffrey Garen.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetByValOnString): For X86 32 bit, construct an indexed address
ourselves to save a register and then load from it.
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (153788 => 153789)
--- trunk/Source/_javascript_Core/ChangeLog 2013-08-07 15:02:39 UTC (rev 153788)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-08-07 16:17:33 UTC (rev 153789)
@@ -1,3 +1,14 @@
+2013-08-06 Michael Saboff <[email protected]>
+
+ REGRESSION(FTL merge): Assertion fail on 32 bit with enabled DFG JIT
+ https://bugs.webkit.org/show_bug.cgi?id=119405
+
+ Reviewed by Geoffrey Garen.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileGetByValOnString): For X86 32 bit, construct an indexed address
+ ourselves to save a register and then load from it.
+
2013-08-06 Filip Pizlo <[email protected]>
DFG FixupPhase should insert Int32ToDouble nodes for number uses in NewArray, and SpeculativeJIT 64-bit should not try to coerce integer constants to double constants
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (153788 => 153789)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-08-07 15:02:39 UTC (rev 153788)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-08-07 16:17:33 UTC (rev 153789)
@@ -2134,10 +2134,17 @@
// 8 bit string values don't need the isASCII check.
cont8Bit.link(&m_jit);
+#if CPU(X86)
+ // Don't have enough register, construct our own indexed address and load.
+ m_jit.lshift32(MacroAssembler::TrustedImm32(2), scratchReg);
+ m_jit.addPtr(MacroAssembler::TrustedImmPtr(m_jit.vm()->smallStrings.singleCharacterStrings()), scratchReg);
+ m_jit.loadPtr(scratchReg, scratchReg);
+#else
GPRTemporary smallStrings(this);
GPRReg smallStringsReg = smallStrings.gpr();
m_jit.move(MacroAssembler::TrustedImmPtr(m_jit.vm()->smallStrings.singleCharacterStrings()), smallStringsReg);
m_jit.loadPtr(MacroAssembler::BaseIndex(smallStringsReg, scratchReg, MacroAssembler::ScalePtr, 0), scratchReg);
+#endif
addSlowPathGenerator(
slowPathCall(
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
