Changeset 94478 in webkit for trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp

Timestamp:

Sep 2, 2011, 10:23:35 PM (14 years ago)

Author:

[email protected]

Message:

DFG JIT speculation failure does recovery of additions in reverse and
doesn't rebox
​https://bugs.webkit.org/show_bug.cgi?id=67551

Reviewed by Sam Weinig.

• dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):

File:

• trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp

@@ -496 +496 @@
         // The only additional recovery we currently support is for integer add operation
         ASSERT(recovery->type() == SpeculativeAdd);
+        ASSERT(check.m_gprInfo[GPRInfo::toIndex(recovery->dest())].nodeIndex != NoNode);
         // Revert the add.
         sub32(recovery->src(), recovery->dest());
+        
+        // If recovery->dest() should have been boxed prior to the addition, then rebox
+        // it.
+        DataFormat format = check.m_gprInfo[GPRInfo::toIndex(recovery->dest())].format;
+        ASSERT(format == DataFormatInteger || format == DataFormatJSInteger || format == DataFormatJS);
+        if (format != DataFormatInteger)
+            orPtr(GPRInfo::tagTypeNumberRegister, recovery->dest());
     }