Changeset 129435 in webkit for trunk/Source/JavaScriptCore/dfg

Timestamp:

Sep 24, 2012, 5:46:45 PM (13 years ago)

Author:

[email protected]

Message:

ValueToInt32 bool case does bad things to registers
​https://bugs.webkit.org/show_bug.cgi?id=97505
<rdar://problem/12356331>

Reviewed by Mark Hahnenberg.

Source/JavaScriptCore:

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileValueToInt32):

LayoutTests:

• fast/js/dfg-bool-to-int32-reuse-expected.txt: Added.
• fast/js/dfg-bool-to-int32-reuse.html: Added.
• fast/js/jsc-test-list:
• fast/js/script-tests/dfg-bool-to-int32-reuse.js: Added.

(foo):

File:

• trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -1908 +1908 @@
         GPRTemporary result(this, op1);
         
-        m_jit.and32(JITCompiler::TrustedImm32(1), op1.gpr());
-        
-        integerResult(op1.gpr(), m_compileIndex);
+        m_jit.move(op1.gpr(), result.gpr());
+        m_jit.and32(JITCompiler::TrustedImm32(1), result.gpr());
+        
+        integerResult(result.gpr(), m_compileIndex);
         return;
     }