Changeset 206149 in webkit
- Timestamp:
- Sep 20, 2016 8:56:42 AM (8 years ago)
- Location:
- trunk
- Files:
-
- 1 added
- 3 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/JSTests/ChangeLog
r206147 r206149 1 2016-09-20 Saam Barati <sbarati@apple.com> 2 3 Unreviewed, added test for x86 32-bit failure for HasOwnProperty node in DFG. 4 5 * stress/has-own-property-called-on-non-object.js: Added. 6 (let.objs): 7 (new.String): 8 (foo): 9 1 10 2016-09-20 Yusuke Suzuki <utatane.tea@gmail.com> 2 11 -
trunk/Source/JavaScriptCore/ChangeLog
r206147 r206149 1 2016-09-20 Saam Barati <sbarati@apple.com> 2 3 Unreviewed fix for 32-bit DFG x86 implementation of HasOwnProperty. 4 5 Fixup phase is always setting ObjectUse on child1() of HasOwnProperty. 6 However, on x86 32-bit, I omitted a call to speculateObject() on child1(). 7 8 * dfg/DFGSpeculativeJIT32_64.cpp: 9 (JSC::DFG::SpeculativeJIT::compile): 10 1 11 2016-09-20 Yusuke Suzuki <utatane.tea@gmail.com> 2 12 -
trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
r206136 r206149 4900 4900 GPRReg objectGPR = object.gpr(); 4901 4901 GPRReg resultGPR = result.gpr(); 4902 4903 speculateObject(node->child1()); 4904 4902 4905 flushRegisters(); 4903 4906 callOperation(operationHasOwnProperty, resultGPR, objectGPR, keyRegs);
Note: See TracChangeset
for help on using the changeset viewer.