Bug 127748

Summary: FTL should support ArrayPush
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: barraclough, ggaren, mark.lam, mhahnenberg, mmirman, msaboff, nrotem, oliver, sam
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Bug Depends on: 127754    
Bug Blocks: 127746    
Attachments:
Description Flags
the patch
none
the patch oliver: review+

Filip Pizlo
Reported 2014-01-27 18:11:08 PST
...
Attachments
the patch (9.36 KB, patch)
2014-01-27 19:47 PST, Filip Pizlo 		no flags
DetailsFormatted DiffDiff
the patch (12.13 KB, patch)
2014-01-28 15:11 PST, Filip Pizlo 		oliver: review+
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2014-01-27 19:47:18 PST
Created attachment 222398 [details] the patch
Filip Pizlo
Comment 2 2014-01-27 20:05:10 PST
Comment on attachment 222398 [details] the patch There's still some bug here.
Filip Pizlo
Comment 3 2014-01-27 20:24:07 PST
This appears to be revealing a latent FTL bug. Yuck. I am investigating.
Filip Pizlo
Comment 4 2014-01-28 12:45:22 PST
It looks like a bug with arity fixup. Those are the best! I'm still investigating.
Filip Pizlo
Comment 5 2014-01-28 12:58:37 PST
Aha! The bug is that the arityFixup code uses regT3, which is a callee-save. Hence if we have an FTL->FTL call that requires fixup, we will clobber things. This should be an easy fix.
Filip Pizlo
Comment 6 2014-01-28 14:12:38 PST
Latent bugs fixed in http://trac.webkit.org/changeset/162958, coming back to working on this.
Filip Pizlo
Comment 7 2014-01-28 15:11:08 PST
Created attachment 222503 [details] the patch
Filip Pizlo
Comment 8 2014-01-28 15:18:44 PST
Landed in http://trac.webkit.org/changeset/162969
Note You need to log in before you can comment on or make changes to this bug.