Changeset 102061 in webkit

Timestamp:

Dec 5, 2011, 4:06:21 PM (15 years ago)

Author:

oliver@apple.com

Message:

Land uncommitted bit of float array support
​https://bugs.webkit.org/show_bug.cgi?id=73873

Reviewed by Filip Pizlo.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-12-05  Oliver Hunt  <oliver@apple.com>
+
+        Land uncommitted bit of float array support
+        https://bugs.webkit.org/show_bug.cgi?id=73873
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+
 2011-12-05  Benjamin Poulain  <benjamin@webkit.org>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -1736 +1736 @@
     ASSERT(speculationRequirements != NoTypedArraySpecCheck);
     MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(baseReg, descriptor.m_lengthOffset));
-    m_jit.breakpoint();
+    GPRTemporary scratch(this);
+    m_jit.move(MacroAssembler::Imm32(0), scratch.gpr());
+    m_jit.convertInt32ToDouble(scratch.gpr(), resultReg);
     MacroAssembler::Jump outOfBounds = m_jit.jump();
     inBounds.link(&m_jit);