Changeset 278662 in webkit

Timestamp:

Jun 9, 2021, 9:31:25 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

[JSC] Fix incorrect register reuse in 32bit after r278568
​https://bugs.webkit.org/show_bug.cgi?id=226817

Patch by Xan Lopez <Xan Lopez> on 2021-06-09
Reviewed by Caio Araujo Neponoceno de Lima.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality):
The JSVALUE32_64 branch potentially needs both the tag and payload
registers for both left/right nodes, so we cannot reuse any of
them for the result since the first thing the code does is set it
zero. Just remove the Reuse construction.

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-06-09  Xan Lopez  <xan@igalia.com>
+
+        [JSC] Fix incorrect register reuse in 32bit after r278568
+        https://bugs.webkit.org/show_bug.cgi?id=226817
+
+        Reviewed by Caio Araujo Neponoceno de Lima.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality):
+        The JSVALUE32_64 branch potentially needs both the tag and payload
+        registers for both left/right nodes, so we cannot reuse any of
+        them for the result since the first thing the code does is set it
+        zero. Just remove the Reuse construction.
+
 2021-06-09  Mikhail R. Gadelha  <mikhail@igalia.com>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -7386 +7386 @@
     GPRTemporary result(this, Reuse, left, right);
 #else
-    GPRTemporary result(this, Reuse, left, PayloadWord);
+    GPRTemporary result(this);
 #endif
     JSValueRegs leftRegs = left.jsValueRegs();