Changeset 92986 in webkit for trunk/Source/JavaScriptCore/dfg/DFGGenerationInfo.h

Timestamp:

Aug 12, 2011, 1:33:25 PM (14 years ago)

Author:

[email protected]

Message:

REGRESSION (r91610?): Bing Maps fail to initialize (InvalidOperation:
Matrix3D.invert)
​https://bugs.webkit.org/show_bug.cgi?id=66038

Patch by Filip Pizlo <​[email protected]> on 2011-08-12
Reviewed by Gavin Barraclough.

Simplest and lowest-impact fix for the case where the spilled format
of a DFG node differs from the register format: if the format is
converted then indicate that the spilled value is no longer valid
("kill the spill").

• dfg/DFGGenerationInfo.h:

(JSC::DFG::GenerationInfo::killSpilled):

• dfg/DFGJITCodeGenerator.cpp:

(JSC::DFG::JITCodeGenerator::fillDouble):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):

File:

• trunk/Source/JavaScriptCore/dfg/DFGGenerationInfo.h (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGGenerationInfo.h

@@ -239 +239 @@
         m_registerFormat = DataFormatNone;
     }
+    
+    void killSpilled()
+    {
+        m_spillFormat = DataFormatNone;
+        m_canFill = false;
+    }
 
     // Record that this value is filled into machine registers,