Changeset 194072 in webkit

Timestamp:

Dec 14, 2015, 4:30:53 PM (11 years ago)

Author:

fpizlo@apple.com

Message:

FTL B3 should be able to run n-body.js
​https://bugs.webkit.org/show_bug.cgi?id=152281

Reviewed by Benjamin Poulain.

Fix a bug where m_captured was pointing to the start of the captured vars slot rather than the
end, like the rest of the FTL expected.

• ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::DFG::LowerDFGToLLVM::lower):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• ftl/FTLLowerDFGToLLVM.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2015-12-14  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should be able to run n-body.js
+        https://bugs.webkit.org/show_bug.cgi?id=152281
+
+        Reviewed by Benjamin Poulain.
+
+        Fix a bug where m_captured was pointing to the start of the captured vars slot rather than the
+        end, like the rest of the FTL expected.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+
 2015-12-14  Benjamin Poulain  <bpoulain@apple.com>
 

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp

@@ -187 +187 @@
 
 #if FTL_USES_B3
-        m_captured = m_out.lockedStackSlot(sizeof(JSValue) * m_graph.m_nextMachineLocal);
+        size_t sizeOfCaptured = sizeof(JSValue) * m_graph.m_nextMachineLocal;
+        LValue capturedBase = m_out.lockedStackSlot(sizeOfCaptured);
+        m_captured = m_out.add(capturedBase, m_out.constIntPtr(sizeOfCaptured));
         m_ftlState.capturedValue = m_captured;
 #else // FTL_USES_B3