Bug 67804

Summary: DFG speculative JIT does not initialize integer tags for PredictInt32 temporaries
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal    
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
the patch fpizlo: commit-queue-

Filip Pizlo
Reported 2011-09-08 14:23:55 PDT
For variables that are PredictInt32, the DFG specualtive JIT does loads and stores on the lower-32-bit payload without boxing and unboxing. This is possible because at the head of the code block, the speculative JIT initializes the tags for all of these variables. But, it neglects to do so for temporaries created by the DFG itself that were then predicted Int32.
Attachments
the patch (1.39 KB, patch)
2011-09-08 14:26 PDT, Filip Pizlo 		fpizlo: commit-queue-
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2011-09-08 14:26:27 PDT
Created attachment 106789 [details] the patch Still running a few tests.
Filip Pizlo
Comment 2 2011-09-08 14:30:36 PDT
Comment on attachment 106789 [details] the patch Looks ready to land.
Filip Pizlo
Comment 3 2011-09-08 14:35:18 PDT
Comment on attachment 106789 [details] the patch Going to land manually.
Filip Pizlo
Comment 4 2011-09-08 14:35:43 PDT
Landed in r94801.
Note You need to log in before you can comment on or make changes to this bug.