Title: [153793] trunk/Source/_javascript_Core
- Revision
- 153793
- Author
- [email protected]
- Date
- 2013-08-07 11:36:31 -0700 (Wed, 07 Aug 2013)
Log Message
32-bit code gen for TypeOf doesn't properly update the AbstractInterpreter state
https://bugs.webkit.org/show_bug.cgi?id=119555
Reviewed by Geoffrey Garen.
It uses a speculationCheck where it should be using a DFG_TYPE_CHECK like the 64-bit backend does.
This was causing crashes on maps.google.com in 32-bit debug builds.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (153792 => 153793)
--- trunk/Source/_javascript_Core/ChangeLog 2013-08-07 18:30:13 UTC (rev 153792)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-08-07 18:36:31 UTC (rev 153793)
@@ -1,3 +1,16 @@
+2013-08-07 Mark Hahnenberg <[email protected]>
+
+ 32-bit code gen for TypeOf doesn't properly update the AbstractInterpreter state
+ https://bugs.webkit.org/show_bug.cgi?id=119555
+
+ Reviewed by Geoffrey Garen.
+
+ It uses a speculationCheck where it should be using a DFG_TYPE_CHECK like the 64-bit backend does.
+ This was causing crashes on maps.google.com in 32-bit debug builds.
+
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+
2013-08-06 Michael Saboff <[email protected]>
REGRESSION(FTL merge): Assertion fail on 32 bit with enabled DFG JIT
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (153792 => 153793)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2013-08-07 18:30:13 UTC (rev 153792)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2013-08-07 18:36:31 UTC (rev 153793)
@@ -4355,7 +4355,7 @@
JITCompiler::Jump isNotCell = m_jit.branch32(JITCompiler::NotEqual, tagGPR, JITCompiler::TrustedImm32(JSValue::CellTag));
if (node->child1().useKind() != UntypedUse)
- speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), node->child1(), isNotCell);
+ DFG_TYPE_CHECK(JSValueRegs(tagGPR, payloadGPR), node->child1(), SpecCell, isNotCell);
if (!node->child1()->shouldSpeculateObject() || node->child1().useKind() == StringUse) {
m_jit.loadPtr(JITCompiler::Address(payloadGPR, JSCell::structureOffset()), tempGPR);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
