Changeset 92710 in webkit

Timestamp:

Aug 9, 2011 2:38:57 PM (13 years ago)

Author:

fpizlo@apple.com

Message:

DFG JIT failure loading web site
​https://bugs.webkit.org/show_bug.cgi?id=65930

Source/JavaScriptCore:

Reviewed by Oliver Hunt.

Put the use() call after the fpr()/gpr() calls, since doing otherwise
breaks the register allocator.

• dfg/DFGNonSpeculativeJIT.cpp:

(JSC::DFG::NonSpeculativeJIT::compile):

LayoutTests:

Reviewed by Oliver Hunt.

Reproduced the failure seen in
​http://www.skinnytaste.com/2011/06/ricotta-cheese-chocolate-chip-muffins.html

• fast/js/boxed-double-to-int-expected.txt: Added.
• fast/js/boxed-double-to-int.html: Added.
• fast/js/script-tests/boxed-double-to-int.js: Added.

(boxedDoubleToInt):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/boxed-double-to-int-expected.txt (added)
• LayoutTests/fast/js/boxed-double-to-int.html (added)
• LayoutTests/fast/js/script-tests/boxed-double-to-int.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-08-09  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT failure loading web site
+        https://bugs.webkit.org/show_bug.cgi?id=65930
+
+        Reviewed by Oliver Hunt.
+        
+        Reproduced the failure seen in
+        http://www.skinnytaste.com/2011/06/ricotta-cheese-chocolate-chip-muffins.html
+
+        * fast/js/boxed-double-to-int-expected.txt: Added.
+        * fast/js/boxed-double-to-int.html: Added.
+        * fast/js/script-tests/boxed-double-to-int.js: Added.
+        (boxedDoubleToInt):
+
 2011-08-09  Anders Carlsson  <andersca@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-08-09  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT failure loading web site
+        https://bugs.webkit.org/show_bug.cgi?id=65930
+
+        Reviewed by Oliver Hunt.
+        
+        Put the use() call after the fpr()/gpr() calls, since doing otherwise
+        breaks the register allocator.
+
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+
 2011-08-09  Mark Hahnenberg  <mhahnenberg@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.cpp

@@ -511 +511 @@
             DoubleOperand op1(this, node.child1());
             GPRTemporary result(this);
+            FPRReg fpr = op1.fpr();
+            GPRReg gpr = result.gpr();
             op1.use();
-            numberToInt32(op1.fpr(), result.gpr());
-            integerResult(result.gpr(), m_compileIndex, UseChildrenCalledExplicitly);
+            numberToInt32(fpr, gpr);
+            integerResult(gpr, m_compileIndex, UseChildrenCalledExplicitly);
             break;
         }