Changeset 194669 in webkit

Timestamp:

Jan 6, 2016 2:21:20 PM (8 years ago)

Author:

mark.lam@apple.com

Message:

REGRESSION(r194613): JITMulGenerator needs a scratch GPR on 32-bit too.
​https://bugs.webkit.org/show_bug.cgi?id=152805

Reviewed by Michael Saboff.

There aren't enough registers on x86 32-bit to allocate the needed scratch GPR.
So, we'll continue to use one of the result registers as the scratch, and
re-compute the result at the end.

• jit/JITMulGenerator.cpp:

(JSC::JITMulGenerator::generateFastPath):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• jit/JITMulGenerator.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-01-06  Mark Lam  <mark.lam@apple.com>
+
+        REGRESSION(r194613): JITMulGenerator needs a scratch GPR on 32-bit too.
+        https://bugs.webkit.org/show_bug.cgi?id=152805
+
+        Reviewed by Michael Saboff.
+
+        There aren't enough registers on x86 32-bit to allocate the needed scratch GPR.
+        So, we'll continue to use one of the result registers as the scratch, and
+        re-compute the result at the end.
+
+        * jit/JITMulGenerator.cpp:
+        (JSC::JITMulGenerator::generateFastPath):
+
 2016-01-06  Anders Carlsson  <andersca@apple.com>
 

trunk/Source/JavaScriptCore/jit/JITMulGenerator.cpp

@@ -36 +36 @@
     ASSERT(m_scratchGPR != m_left.payloadGPR());
     ASSERT(m_scratchGPR != m_right.payloadGPR());
+#if USE(JSVALUE64)
     ASSERT(m_scratchGPR != m_result.payloadGPR());
-#if USE(JSVALUE32_64)
+#else
     ASSERT(m_scratchGPR != m_left.tagGPR());
     ASSERT(m_scratchGPR != m_right.tagGPR());
@@ -181 +182 @@
 
         m_endJumpList.append(noInt52Overflow);
+        if (m_scratchGPR == m_result.tagGPR() || m_scratchGPR == m_result.payloadGPR())
+            jit.boxDouble(m_leftFPR, m_result);
+
         m_endJumpList.append(done);
 #endif