Changeset 143800 in webkit

Timestamp:

Feb 22, 2013, 2:38:14 PM (12 years ago)

Author:

fpizlo@apple.com

Message:

REGRESSION(r143654): some fast/js test crashes on 32 bit build
​https://bugs.webkit.org/show_bug.cgi?id=110590

Reviewed by Mark Hahnenberg.

In compileValueToInt32, the refactoring in r143654 undid one of the fixes from
r143314 due to a merge goof.

In speculateNumber, we were simply forgetting to indicate that we need a
ManualOperandSpeculation on a JSValueOperand. ManualOperandSpeculation should
be passed whenever you will be performing the type checks yourself rather than
using the operand class to do it for you.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileValueToInt32):
(JSC::DFG::SpeculativeJIT::speculateNumber):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGSpeculativeJIT.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2013-02-22  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r143654): some fast/js test crashes on 32 bit build
+        https://bugs.webkit.org/show_bug.cgi?id=110590
+
+        Reviewed by Mark Hahnenberg.
+        
+        In compileValueToInt32, the refactoring in r143654 undid one of the fixes from
+        r143314 due to a merge goof.
+        
+        In speculateNumber, we were simply forgetting to indicate that we need a
+        ManualOperandSpeculation on a JSValueOperand. ManualOperandSpeculation should
+        be passed whenever you will be performing the type checks yourself rather than
+        using the operand class to do it for you.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::speculateNumber):
+
 2013-02-22  Geoffrey Garen  <ggaren@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -2289 +2289 @@
         }
         case GeneratedOperandTypeUnknown:
-            RELEASE_ASSERT_NOT_REACHED();
+            RELEASE_ASSERT(!m_compileOkay);
             return;
         }
@@ -3945 +3945 @@
     isInteger.link(&m_jit);
 #else
-    JSValueOperand op1(this, edge);
+    JSValueOperand op1(this, edge, ManualOperandSpeculation);
     JITCompiler::Jump isInteger = m_jit.branch32(MacroAssembler::Equal, operand.tagGPR(), TrustedImm32(JSValue::Int32Tag));
     typeCheck(