Commit 0e269132 authored by mhahnenberg@apple.com's avatar mhahnenberg@apple.com
Browse files

REGRESSION(r144131): It made fast/js/regress/string-repeat-arith.html assert on 32 bit

https://bugs.webkit.org/show_bug.cgi?id=112106

Rubber stamped by Filip Pizlo.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32): Get rid of the case for constants because
we would have done constant folding anyways on a ValueToInt32.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): Fixed a random compile error with this flag enabled.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146945 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 95572ae6
2013-03-26 Mark Hahnenberg <mhahnenberg@apple.com>
REGRESSION(r144131): It made fast/js/regress/string-repeat-arith.html assert on 32 bit
https://bugs.webkit.org/show_bug.cgi?id=112106
Rubber stamped by Filip Pizlo.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32): Get rid of the case for constants because
we would have done constant folding anyways on a ValueToInt32.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): Fixed a random compile error with this flag enabled.
2013-03-26 Filip Pizlo <fpizlo@apple.com> 2013-03-26 Filip Pizlo <fpizlo@apple.com>
   
JSC_enableProfiler=true should also cause JSGlobalData to save the profiler output somewhere JSC_enableProfiler=true should also cause JSGlobalData to save the profiler output somewhere
......
...@@ -2096,22 +2096,6 @@ GeneratedOperandType SpeculativeJIT::checkGeneratedTypeForToInt32(Node* node) ...@@ -2096,22 +2096,6 @@ GeneratedOperandType SpeculativeJIT::checkGeneratedTypeForToInt32(Node* node)
VirtualRegister virtualRegister = node->virtualRegister(); VirtualRegister virtualRegister = node->virtualRegister();
GenerationInfo& info = m_generationInfo[virtualRegister]; GenerationInfo& info = m_generationInfo[virtualRegister];
if (info.registerFormat() == DataFormatNone) {
if (node->hasConstant()) {
if (isInt32Constant(node))
return GeneratedOperandInteger;
if (isNumberConstant(node))
return GeneratedOperandDouble;
terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
return GeneratedOperandTypeUnknown;
}
if (info.spillFormat() == DataFormatDouble)
return GeneratedOperandDouble;
}
switch (info.registerFormat()) { switch (info.registerFormat()) {
case DataFormatStorage: case DataFormatStorage:
RELEASE_ASSERT_NOT_REACHED(); RELEASE_ASSERT_NOT_REACHED();
......
...@@ -1173,7 +1173,7 @@ GPRReg SpeculativeJIT::fillSpeculateCell(Edge edge) ...@@ -1173,7 +1173,7 @@ GPRReg SpeculativeJIT::fillSpeculateCell(Edge edge)
GPRReg SpeculativeJIT::fillSpeculateBoolean(Edge edge) GPRReg SpeculativeJIT::fillSpeculateBoolean(Edge edge)
{ {
#if DFG_ENABLE(DEBUG_VERBOSE) #if DFG_ENABLE(DEBUG_VERBOSE)
dataLogF("SpecBool@%d ", node->index()); dataLogF("SpecBool@%d ", edge.node()->index());
#endif #endif
AbstractValue& value = m_state.forNode(edge); AbstractValue& value = m_state.forNode(edge);
SpeculatedType type = value.m_type; SpeculatedType type = value.m_type;
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment