Changeset 97003 in webkit for trunk/Source/JavaScriptCore/ChangeLog

Timestamp:

Oct 8, 2011, 12:04:06 AM (14 years ago)

Author:

[email protected]

Message:

bug fixes for ArrayPush and ArrayPop in 32_64 DFG JIT
​https://bugs.webkit.org/show_bug.cgi?id=69696

Patch by Yuqiang Xian <​[email protected]> on 2011-10-07
Reviewed by Filip Pizlo.

On 32-bit, we should use TimesEight (8) instead of ScalePtr (4)
to compute the address of a JS array element.

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

File:

• trunk/Source/JavaScriptCore/ChangeLog (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-10-07  Yuqiang Xian  <[email protected]>
+
+        bug fixes for ArrayPush and ArrayPop in 32_64 DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=69696
+
+        Reviewed by Filip Pizlo.
+
+        On 32-bit, we should use TimesEight (8) instead of ScalePtr (4)
+        to compute the address of a JS array element.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
 2011-10-07  Mark Hahnenberg  <[email protected]>