Changeset 37268 in webkit for trunk/JavaScriptCore/kjs

Timestamp:

Oct 3, 2008, 5:10:29 PM (17 years ago)

Author:

[email protected]

Message:

2008-10-03 Cameron Zwarich <​[email protected]>

Reviewed by Maciej Stachowiak.

Bug 21343: REGRESSSION (r37160): ecma_3/ExecutionContexts/10.1.3-1.js and js1_4/Functions/function-001.js fail on 64-bit
<​https://bugs.webkit.org/show_bug.cgi?id=21343>

A fix was landed for this issue in r37253, and the ChangeLog assumes
that it is a compiler bug, but it turns out that it is a subtle issue
with mixing signed and unsigned 32-bit values in a 64-bit environment.
In order to properly fix this bug, we should convert our signed offsets
into the register file to use ptrdiff_t.

This may not be the only instance of this issue, but I will land this
fix first and look for more later.

• VM/Machine.cpp: (JSC::Machine::getArgumentsData):
• VM/Machine.h:
• kjs/Arguments.cpp: (JSC::Arguments::getOwnPropertySlot):
• kjs/Arguments.h: (JSC::Arguments::init):

Location:

trunk/JavaScriptCore/kjs

Files:

• Arguments.cpp (modified) (2 diffs)
• Arguments.h (modified) (2 diffs)

trunk/JavaScriptCore/kjs/Arguments.cpp

@@ -112 +112 @@
     if (i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
         if (i < d->numParameters) {
-#if COMPILER(GCC) && PLATFORM(X86_64)
-            // The subscript variable is a workaround for a 64-bit code
-            // generation bug in GCC.
-            int subscript = d->firstParameterIndex + i;
-            slot.setRegisterSlot(&d->registers[subscript]);
-#else
             slot.setRegisterSlot(&d->registers[d->firstParameterIndex + i]);
-#endif
         } else
             slot.setValue(d->extraArguments[i - d->numParameters].jsValue(exec));
@@ -134 +127 @@
     if (isArrayIndex && i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
         if (i < d->numParameters) {
-#if COMPILER(GCC) && PLATFORM(X86_64)
-            // The subscript variable is a workaround for a 64-bit code
-            // generation bug in GCC.
-            int subscript = d->firstParameterIndex + i;
-            slot.setRegisterSlot(&d->registers[subscript]);
-#else
             slot.setRegisterSlot(&d->registers[d->firstParameterIndex + i]);
-#endif
         } else
             slot.setValue(d->extraArguments[i - d->numParameters].jsValue(exec));

trunk/JavaScriptCore/kjs/Arguments.h

@@ -36 +36 @@
 
         unsigned numParameters;
-        int firstParameterIndex;
+        ptrdiff_t firstParameterIndex;
         unsigned numArguments;
 
@@ -85 +85 @@
     {
         JSFunction* callee;
-        int firstParameterIndex;
+        ptrdiff_t firstParameterIndex;
         Register* argv;
         int numArguments;