Changeset 172282 in webkit for trunk/Source/JavaScriptCore/dfg

Timestamp:

Aug 7, 2014, 3:08:19 PM (11 years ago)

Author:

[email protected]

Message:

SpeculateInt32Operand is sometimes used in a 64-bit context, which has undefined behavior
​https://bugs.webkit.org/show_bug.cgi?id=135722

Reviewed by Filip Pizlo.

We should be using SpeculateStrictInt32Operand instead.

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

File:

• trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (modified) (5 diffs)

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

@@ -4722 +4722 @@
     case HasIndexedProperty: {
         SpeculateCellOperand base(this, node->child1());
-        SpeculateInt32Operand index(this, node->child2());
+        SpeculateStrictInt32Operand index(this, node->child2());
         GPRResult result(this);
 
@@ -4807 +4807 @@
         SpeculateCellOperand base(this, baseEdge);
         SpeculateCellOperand property(this, propertyEdge);
-        SpeculateInt32Operand index(this, indexEdge);
+        SpeculateStrictInt32Operand index(this, indexEdge);
         SpeculateCellOperand enumerator(this, enumeratorEdge);
         GPRResult result(this);
@@ -4877 +4877 @@
     case GetEnumeratorPname: {
         SpeculateCellOperand enumerator(this, node->child1());
-        SpeculateInt32Operand index(this, node->child2());
+        SpeculateStrictInt32Operand index(this, node->child2());
         GPRTemporary scratch1(this);
-        GPRTemporary scratch2(this);
         GPRResult result(this);
 
@@ -4885 +4884 @@
         GPRReg indexGPR = index.gpr();
         GPRReg scratch1GPR = scratch1.gpr();
-        GPRReg scratch2GPR = scratch2.gpr();
         GPRReg resultGPR = result.gpr();
 
@@ -4897 +4895 @@
 
         m_jit.loadPtr(MacroAssembler::Address(enumeratorGPR, JSPropertyNameEnumerator::cachedPropertyNamesVectorOffset()), scratch1GPR);
-        m_jit.move(indexGPR, scratch2GPR);
-        m_jit.signExtend32ToPtr(scratch2GPR, scratch2GPR);
-        m_jit.load64(MacroAssembler::BaseIndex(scratch1GPR, scratch2GPR, MacroAssembler::TimesEight), resultGPR);
+        m_jit.load64(MacroAssembler::BaseIndex(scratch1GPR, indexGPR, MacroAssembler::TimesEight), resultGPR);
 
         done.link(&m_jit);