Changeset 154298 in webkit for trunk/Source/JavaScriptCore/assembler

Timestamp:

Aug 19, 2013, 2:26:10 PM (12 years ago)

Author:

[email protected]

Message:

​https://bugs.webkit.org/show_bug.cgi?id=120020 Change Set 154207 causes wrong register to be used for 32 bit tests

Reviewed by Benjamin Poulain.

Change branshTest32 to only use the byte for 8 bit test on the lower 4 registers.
Registers 4 through 7 as byte regisers are ah, ch, dh and bh instead of sp, bp, si and di.

• assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::branchTest32):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateCell):

File:

• trunk/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h (modified) (1 diff)

trunk/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h

@@ -1141 +1141 @@
         if (mask.m_value == -1)
             m_assembler.testl_rr(reg, reg);
-        else if (!(mask.m_value & ~0xff))
+        else if (!(mask.m_value & ~0xff) && reg < X86Registers::esp) // Using esp and greater as a byte register yields the upper half of the 16 bit registers ax, cx, dx and bx, e.g. esp, register 4, is actually ah.
             m_assembler.testb_i8r(mask.m_value, reg);
         else