Changeset 178788 in webkit for trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

Timestamp:

Jan 20, 2015, 5:12:51 PM (11 years ago)

Author:

[email protected]

Message:

Made Identity in the DFG allocate a new temp register and move
the old data to it.
​https://bugs.webkit.org/show_bug.cgi?id=140700
<rdar://problem/19339106>

Reviewed by Filip Pizlo.

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):
Added scratch registers for Identity.

• tests/mozilla/mozilla-tests.yaml: enabled previously failing test

File:

• trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

@@ -1800 +1800 @@
         case DoubleRepMachineIntUse: {
             SpeculateDoubleOperand op(this, node->child1());
-            doubleResult(op.fpr(), node);
+            FPRTemporary scratch(this, op);
+            m_jit.moveDouble(op.fpr(), scratch.fpr());
+            doubleResult(scratch.fpr(), node);
             break;
         }
         case Int52RepUse: {
             SpeculateInt52Operand op(this, node->child1());
-            int52Result(op.gpr(), node);
+            GPRTemporary result(this, Reuse, op);
+            m_jit.move(op.gpr(), result.gpr());
+            int52Result(result.gpr(), node);
             break;
         }
         default: {
             JSValueOperand op(this, node->child1());
-            jsValueResult(op.gpr(), node);
+            GPRTemporary result(this, Reuse, op);
+            m_jit.move(op.gpr(), result.gpr());
+            jsValueResult(result.gpr(), node);
             break;
         }