-
fpizlo@apple.com authored
UInt32ToNumber and OSR exit should be aware of copy propagation and correctly recover both versions of a variable that was subject to a UInt32ToNumber cast https://bugs.webkit.org/show_bug.cgi?id=99100 <rdar://problem/12480955> Reviewed by Michael Saboff and Mark Hahnenberg. Source/JavaScriptCore: Fixed by forcing UInt32ToNumber to use a different register. This "undoes" the copy propagation that we would have been doing, since it has no performance effect in this case and has the benefit of making the OSR exit compiler a lot simpler. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber): LayoutTests: * fast/js/dfg-uint32-to-number-in-middle-of-copy-propagation-expected.txt: Added. * fast/js/dfg-uint32-to-number-in-middle-of-copy-propagation.html: Added. * fast/js/jsc-test-list: * fast/js/script-tests/dfg-uint32-to-number-in-middle-of-copy-propagation.js: Added. (foo): git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131097 268f45cc-cd09-0410-ab3c-d52691b4dbfc
617c3793