Title: [153802] branches/safari-537-branch/Source/_javascript_Core
- Revision
- 153802
- Author
- [email protected]
- Date
- 2013-08-07 14:44:06 -0700 (Wed, 07 Aug 2013)
Log Message
Merged r153793. <rdar://problem/14666354>
Modified Paths
Diff
Modified: branches/safari-537-branch/Source/_javascript_Core/ChangeLog (153801 => 153802)
--- branches/safari-537-branch/Source/_javascript_Core/ChangeLog 2013-08-07 21:38:45 UTC (rev 153801)
+++ branches/safari-537-branch/Source/_javascript_Core/ChangeLog 2013-08-07 21:44:06 UTC (rev 153802)
@@ -1,5 +1,22 @@
2013-08-07 Lucas Forschler <[email protected]>
+ Merge r153793
+
+ 2013-08-07 Mark Hahnenberg <[email protected]>
+
+ 32-bit code gen for TypeOf doesn't properly update the AbstractInterpreter state
+ https://bugs.webkit.org/show_bug.cgi?id=119555
+
+ Reviewed by Geoffrey Garen.
+
+ It uses a speculationCheck where it should be using a DFG_TYPE_CHECK like the 64-bit backend does.
+ This was causing crashes on maps.google.com in 32-bit debug builds.
+
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+
+2013-08-07 Lucas Forschler <[email protected]>
+
Merge r153374
2013-07-19 Mark Hahnenberg <[email protected]>
Modified: branches/safari-537-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (153801 => 153802)
--- branches/safari-537-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2013-08-07 21:38:45 UTC (rev 153801)
+++ branches/safari-537-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2013-08-07 21:44:06 UTC (rev 153802)
@@ -4399,7 +4399,7 @@
JITCompiler::Jump isNotCell = m_jit.branch32(JITCompiler::NotEqual, tagGPR, JITCompiler::TrustedImm32(JSValue::CellTag));
if (node->child1().useKind() != UntypedUse)
- speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), node->child1(), isNotCell);
+ DFG_TYPE_CHECK(JSValueRegs(tagGPR, payloadGPR), node->child1(), SpecCell, isNotCell);
if (!node->child1()->shouldSpeculateObject() || node->child1().useKind() == StringUse) {
m_jit.loadPtr(JITCompiler::Address(payloadGPR, JSCell::structureOffset()), tempGPR);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
