Changeset 172959 in webkit

Timestamp:

Aug 26, 2014 8:55:01 AM (10 years ago)

Author:

msaboff@apple.com

Message:

REGRESSION(r172794) + 32Bit build: ASSERT failures in for-in-tests.js tests.
​https://bugs.webkit.org/show_bug.cgi?id=136165

Reviewed by Mark Hahnenberg.

Changed switch case GetDirectPname: to always use the slow path for X86 since it only has
6 registers available, but the code requires 7.

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGSpeculativeJIT32_64.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-08-26  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r172794) + 32Bit build: ASSERT failures in for-in-tests.js tests.
+        https://bugs.webkit.org/show_bug.cgi?id=136165
+
+        Reviewed by Mark Hahnenberg.
+
+        Changed switch case GetDirectPname: to always use the slow path for X86 since it only has
+        6 registers available, but the code requires 7.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
 2014-08-25  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

@@ -4723 +4723 @@
         Edge& baseEdge = m_jit.graph().varArgChild(node, 0);
         Edge& propertyEdge = m_jit.graph().varArgChild(node, 1);
-        Edge& indexEdge = m_jit.graph().varArgChild(node, 2);
-        Edge& enumeratorEdge = m_jit.graph().varArgChild(node, 3);
 
         SpeculateCellOperand base(this, baseEdge);
         SpeculateCellOperand property(this, propertyEdge);
-        SpeculateInt32Operand index(this, indexEdge);
-        SpeculateCellOperand enumerator(this, enumeratorEdge);
         GPRResult resultPayload(this);
         GPRResult2 resultTag(this);
@@ -4736 +4732 @@
         GPRReg baseGPR = base.gpr();
         GPRReg propertyGPR = property.gpr();
-        GPRReg indexGPR = index.gpr();
-        GPRReg enumeratorGPR = enumerator.gpr();
         GPRReg resultTagGPR = resultTag.gpr();
         GPRReg resultPayloadGPR = resultPayload.gpr();
         GPRReg scratchGPR = scratch.gpr();
+
+#if CPU(X86)
+        // Not enough registers on X86 for this code, so always use the slow path.
+        flushRegisters();
+        m_jit.move(MacroAssembler::TrustedImm32(JSValue::CellTag), scratchGPR);
+        callOperation(operationGetByValCell, resultTagGPR, resultPayloadGPR, baseGPR, scratchGPR, propertyGPR);
+#else
+        Edge& indexEdge = m_jit.graph().varArgChild(node, 2);
+        Edge& enumeratorEdge = m_jit.graph().varArgChild(node, 3);
+
+        SpeculateInt32Operand index(this, indexEdge);
+        SpeculateCellOperand enumerator(this, enumeratorEdge);
+
+        GPRReg indexGPR = index.gpr();
+        GPRReg enumeratorGPR = enumerator.gpr();
 
         // Check the structure
@@ -4776 +4785 @@
         m_jit.move(MacroAssembler::TrustedImm32(JSValue::CellTag), scratchGPR);
         addSlowPathGenerator(slowPathCall(wrongStructure, this, operationGetByValCell, resultTagGPR, resultPayloadGPR, baseGPR, scratchGPR, propertyGPR));
+#endif
 
         jsValueResult(resultTagGPR, resultPayloadGPR, node);