Title: [96389] trunk/Source/_javascript_Core
- Revision
- 96389
- Author
- commit-qu...@webkit.org
- Date
- 2011-09-29 22:15:58 -0700 (Thu, 29 Sep 2011)
Log Message
DFG JIT - register not unlocked after usage in ArithDiv
https://bugs.webkit.org/show_bug.cgi?id=69122
Patch by Yuqiang Xian <yuqiang.x...@intel.com> on 2011-09-29
Reviewed by Geoffrey Garen.
Some allocated register is not unlocked after the usage in ArithDiv.
Also there's a typo in "ENBALE_DFG_CONSISTENTCY_CHECK".
* dfg/DFGNode.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (96388 => 96389)
--- trunk/Source/_javascript_Core/ChangeLog 2011-09-30 05:05:53 UTC (rev 96388)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-09-30 05:15:58 UTC (rev 96389)
@@ -1,3 +1,19 @@
+2011-09-29 Yuqiang Xian <yuqiang.x...@intel.com>
+
+ DFG JIT - register not unlocked after usage in ArithDiv
+ https://bugs.webkit.org/show_bug.cgi?id=69122
+
+ Reviewed by Geoffrey Garen.
+
+ Some allocated register is not unlocked after the usage in ArithDiv.
+ Also there's a typo in "ENBALE_DFG_CONSISTENTCY_CHECK".
+
+ * dfg/DFGNode.h:
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+
2011-09-29 Mark Hahnenberg <mhahnenb...@apple.com>
De-virtualize JSCell::toObject
Modified: trunk/Source/_javascript_Core/dfg/DFGNode.h (96388 => 96389)
--- trunk/Source/_javascript_Core/dfg/DFGNode.h 2011-09-30 05:05:53 UTC (rev 96388)
+++ trunk/Source/_javascript_Core/dfg/DFGNode.h 2011-09-30 05:15:58 UTC (rev 96389)
@@ -44,7 +44,7 @@
#define ENABLE_DFG_JIT_ASSERT 0
#endif
// Consistency check contents compiler data structures.
-#define ENBALE_DFG_CONSISTENCY_CHECK 0
+#define ENABLE_DFG_CONSISTENCY_CHECK 0
// Emit a breakpoint into the head of every generated function, to aid debugging in GDB.
#define ENABLE_DFG_JIT_BREAK_ON_EVERY_FUNCTION 0
// Emit a breakpoint into the head of every generated node, to aid debugging in GDB.
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (96388 => 96389)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2011-09-30 05:05:53 UTC (rev 96388)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2011-09-30 05:15:58 UTC (rev 96389)
@@ -903,6 +903,9 @@
m_jit.assembler().cdq();
m_jit.assembler().idivl_r(op2GPR);
+ if (temp2 != InvalidGPRReg)
+ unlock(temp2);
+
// Check that there was no remainder. If there had been, then we'd be obligated to
// produce a double result instead.
speculationCheck(m_jit.branchTest32(JITCompiler::NonZero, edx.gpr()));
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (96388 => 96389)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2011-09-30 05:05:53 UTC (rev 96388)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2011-09-30 05:15:58 UTC (rev 96389)
@@ -998,6 +998,9 @@
m_jit.assembler().cdq();
m_jit.assembler().idivl_r(op2GPR);
+ if (temp2 != InvalidGPRReg)
+ unlock(temp2);
+
// Check that there was no remainder. If there had been, then we'd be obligated to
// produce a double result instead.
speculationCheck(m_jit.branchTest32(JITCompiler::NonZero, edx.gpr()));
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
