Changeset 92986 in webkit for trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

Timestamp:

Aug 12, 2011, 1:33:25 PM (14 years ago)

Author:

[email protected]

Message:

REGRESSION (r91610?): Bing Maps fail to initialize (InvalidOperation:
Matrix3D.invert)
​https://bugs.webkit.org/show_bug.cgi?id=66038

Patch by Filip Pizlo <​[email protected]> on 2011-08-12
Reviewed by Gavin Barraclough.

Simplest and lowest-impact fix for the case where the spilled format
of a DFG node differs from the register format: if the format is
converted then indicate that the spilled value is no longer valid
("kill the spill").

• dfg/DFGGenerationInfo.h:

(JSC::DFG::GenerationInfo::killSpilled):

• dfg/DFGJITCodeGenerator.cpp:

(JSC::DFG::JITCodeGenerator::fillDouble):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):

File:

• trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -256 +256 @@
         m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
         info.fillDouble(fpr);
+        info.killSpilled();
         return fpr;
     }