Changeset 96980 in webkit

Timestamp:

Oct 7, 2011 1:52:56 PM (13 years ago)

Author:

fpizlo@apple.com

Message:

DFG ConvertThis speculation logic is wrong
​https://bugs.webkit.org/show_bug.cgi?id=69663

Reviewed by Oliver Hunt.

• dfg/DFGPropagator.cpp:

(JSC::DFG::Propagator::fixupNode):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGPropagator.cpp (modified) (1 diff)
• dfg/DFGSpeculativeJIT32_64.cpp (modified) (2 diffs)
• dfg/DFGSpeculativeJIT64.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-10-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG ConvertThis speculation logic is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=69663
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::fixupNode):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
 2011-10-07  Oliver Hunt  <oliver@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGPropagator.cpp

@@ -721 +721 @@
             
 #if ENABLE(DFG_DEBUG_PROPAGATION_VERBOSE)
-            printf("  @%u -> %s", nodeIndex, isArray ? "GetArrayLength" : "GetStringLength");
+            printf("  @%u -> %s", m_compileIndex, isArray ? "GetArrayLength" : "GetStringLength");
 #endif
             node.op = isArray ? GetArrayLength : GetStringLength;

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

@@ -1711 +1711 @@
         
     case ConvertThis: {
-        if (isOtherPrediction(node.prediction())) {
+        if (isOtherPrediction(at(node.child1()).prediction())) {
             JSValueOperand thisValue(this, node.child1());
             GPRTemporary scratch(this, thisValue);
@@ -1727 +1727 @@
         }
         
-        if (isObjectPrediction(node.prediction())) {
+        if (isObjectPrediction(at(node.child1()).prediction())) {
             SpeculateCellOperand thisValue(this, node.child1());
             

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

@@ -1787 +1787 @@
         
     case ConvertThis: {
-        if (isOtherPrediction(node.prediction())) {
+        if (isOtherPrediction(at(node.child1()).prediction())) {
             JSValueOperand thisValue(this, node.child1());
             GPRTemporary scratch(this, thisValue);
@@ -1802 +1802 @@
         }
         
-        if (isObjectPrediction(node.prediction())) {
+        if (isObjectPrediction(at(node.child1()).prediction())) {
             SpeculateCellOperand thisValue(this, node.child1());