Changeset 97013 in webkit


Ignore:
Timestamp:
Oct 8, 2011 1:40:03 PM (12 years ago)
Author:
commit-queue@webkit.org
Message:

JSVALUE32_64 DFG JIT - Bug fixes for Branch and LogicalNot
https://bugs.webkit.org/show_bug.cgi?id=69702

Patch by Yuqiang Xian <yuqiang.xian@intel.com> on 2011-10-08
Reviewed by Filip Pizlo.

There are some errors in generating code for Branch and LogicalNot,
when the operand is predicted as ObjectOrOther.

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
(JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):

Location:
trunk/Source/JavaScriptCore
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/Source/JavaScriptCore/ChangeLog

    r97006 r97013  
     12011-10-08  Yuqiang Xian  <yuqiang.xian@intel.com>
     2
     3        JSVALUE32_64 DFG JIT - Bug fixes for Branch and LogicalNot
     4        https://bugs.webkit.org/show_bug.cgi?id=69702
     5
     6        Reviewed by Filip Pizlo.
     7
     8        There are some errors in generating code for Branch and LogicalNot,
     9        when the operand is predicted as ObjectOrOther.
     10
     11        * dfg/DFGSpeculativeJIT32_64.cpp:
     12        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
     13        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
     14
    1152011-10-08  Sheriff Bot  <webkit.review.bot@gmail.com>
    216
  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r97003 r97013  
    453453    MacroAssembler::Jump notCell = m_jit.branch32(MacroAssembler::NotEqual, valueTagGPR, TrustedImm32(JSValue::CellTag));
    454454    speculationCheck(m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(valuePayloadGPR), MacroAssembler::TrustedImmPtr(vptr)));
    455     m_jit.move(TrustedImm32(1), resultPayloadGPR);
     455    m_jit.move(TrustedImm32(0), resultPayloadGPR);
    456456    MacroAssembler::Jump done = m_jit.jump();
    457457   
    458458    notCell.link(&m_jit);
    459    
    460     m_jit.move(valueTagGPR, resultPayloadGPR);
    461     m_jit.and32(MacroAssembler::TrustedImm32(JSValue::UndefinedTag), resultPayloadGPR);
    462     speculationCheck(m_jit.branch32(MacroAssembler::NotEqual, resultPayloadGPR, TrustedImm32(JSValue::UndefinedTag)));
    463     m_jit.move(TrustedImm32(0), resultPayloadGPR);
     459 
     460    MacroAssembler::Jump isNull = m_jit.branch32(MacroAssembler::Equal, valueTagGPR, TrustedImm32(JSValue::NullTag));
     461    speculationCheck(m_jit.branch32(MacroAssembler::NotEqual, valueTagGPR, TrustedImm32(JSValue::UndefinedTag)));
     462
     463    isNull.link(&m_jit);
     464
     465    m_jit.move(TrustedImm32(1), resultPayloadGPR);
    464466   
    465467    done.link(&m_jit);
     
    555557    notCell.link(&m_jit);
    556558   
    557     m_jit.and32(MacroAssembler::TrustedImm32(JSValue::UndefinedTag), valueTagGPR);
     559    MacroAssembler::Jump isNull = m_jit.branch32(MacroAssembler::Equal, valueTagGPR, TrustedImm32(JSValue::NullTag));
    558560    speculationCheck(m_jit.branch32(MacroAssembler::NotEqual, valueTagGPR, TrustedImm32(JSValue::UndefinedTag)));
     561
     562    isNull.link(&m_jit);
     563
    559564    if (notTaken != (m_block + 1))
    560565        addBranch(m_jit.jump(), notTaken);
Note: See TracChangeset for help on using the changeset viewer.