Changeset 43481 in webkit for trunk/JavaScriptCore/jit/JITPropertyAccess.cpp

Timestamp:

May 10, 2009, 11:06:30 PM (16 years ago)

Author:

[email protected]

Message:

2009-05-10 Maciej Stachowiak <​[email protected]>

Reviewed by Geoff Garen.

• fixed REGRESSION(r43432): Many JavaScriptCore tests crash in 64-bit ​https://bugs.webkit.org/show_bug.cgi?id=25680

Accound for the 64-bit instruction prefix when rewriting mov to lea on 64-bit.

• jit/JIT.h:
• jit/JITPropertyAccess.cpp: (JSC::JIT::patchGetByIdSelf): (JSC::JIT::patchPutByIdReplace):

File:

• trunk/JavaScriptCore/jit/JITPropertyAccess.cpp (modified) (2 diffs)

trunk/JavaScriptCore/jit/JITPropertyAccess.cpp

@@ -331 +331 @@
     // and makes the subsequent load's offset automatically correct
     if (structure->isUsingInlineStorage())
-        stubInfo->hotPathBegin.instructionAtOffset(patchOffsetGetByIdExternalLoad).patchLoadToLEA();
+        stubInfo->hotPathBegin.instructionAtOffset(patchOffsetGetByIdExternalLoad + patchLengthGetByIdExternalLoadPrefix).patchLoadToLEA();
 
     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
@@ -349 +349 @@
     // and makes the subsequent load's offset automatically correct
     if (structure->isUsingInlineStorage())
-        stubInfo->hotPathBegin.instructionAtOffset(patchOffsetGetByIdExternalLoad).patchLoadToLEA();
+        stubInfo->hotPathBegin.instructionAtOffset(patchOffsetPutByIdExternalLoad + patchLengthPutByIdExternalLoadPrefix).patchLoadToLEA();
 
     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.