Title: [194315] trunk/Source/_javascript_Core
- Revision
- 194315
- Author
- [email protected]
- Date
- 2015-12-19 11:01:50 -0800 (Sat, 19 Dec 2015)
Log Message
[JSC] FTLB3Output generates some invalid ZExt32
https://bugs.webkit.org/show_bug.cgi?id=151905
Patch by Benjamin Poulain <[email protected]> on 2015-12-19
Reviewed by Filip Pizlo.
FTLLowerDFGToLLVM calls zeroExt() to int32 in some cases.
We were generating ZExt32 with Int32 as return type :(
* ftl/FTLB3Output.h:
(JSC::FTL::Output::zeroExt):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (194314 => 194315)
--- trunk/Source/_javascript_Core/ChangeLog 2015-12-19 16:52:11 UTC (rev 194314)
+++ trunk/Source/_javascript_Core/ChangeLog 2015-12-19 19:01:50 UTC (rev 194315)
@@ -1,5 +1,18 @@
2015-12-19 Benjamin Poulain <[email protected]>
+ [JSC] FTLB3Output generates some invalid ZExt32
+ https://bugs.webkit.org/show_bug.cgi?id=151905
+
+ Reviewed by Filip Pizlo.
+
+ FTLLowerDFGToLLVM calls zeroExt() to int32 in some cases.
+ We were generating ZExt32 with Int32 as return type :(
+
+ * ftl/FTLB3Output.h:
+ (JSC::FTL::Output::zeroExt):
+
+2015-12-19 Benjamin Poulain <[email protected]>
+
[JSC] Add EqualOrUnordered to B3
https://bugs.webkit.org/show_bug.cgi?id=152425
Modified: trunk/Source/_javascript_Core/ftl/FTLB3Output.h (194314 => 194315)
--- trunk/Source/_javascript_Core/ftl/FTLB3Output.h 2015-12-19 16:52:11 UTC (rev 194314)
+++ trunk/Source/_javascript_Core/ftl/FTLB3Output.h 2015-12-19 19:01:50 UTC (rev 194315)
@@ -179,7 +179,12 @@
LValue sensibleDoubleToInt(LValue) { CRASH(); }
LValue signExt32To64(LValue value) { return m_block->appendNew<B3::Value>(m_proc, B3::SExt32, origin(), value); }
- LValue zeroExt(LValue value, LType type) { return m_block->appendNew<B3::Value>(m_proc, B3::ZExt32, type, origin(), value); }
+ LValue zeroExt(LValue value, LType type)
+ {
+ if (value->type() == type)
+ return value;
+ return m_block->appendNew<B3::Value>(m_proc, B3::ZExt32, origin(), value);
+ }
LValue zeroExtPtr(LValue value) { return zeroExt(value, B3::Int64); }
LValue fpToInt32(LValue value) { CRASH(); }
LValue fpToUInt32(LValue value) { CRASH(); }
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
