Bug 172383 – DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Mark Lam]

pickCanTrample() is wrongly assuming that one of regT0 and regT1 is always available as a scratch register.  This assumption is wrong if this canTrample register is used for a silentFill() after an operation that returns a result in regT0 or regT1.

Turns out the only reason we need the canTrample register is for SetDoubleConstant.  We can remove the need for this canTrample register by introducing a moveDouble() pseudo instruction in the MacroAssembler to do the job using the scratchRegister() on X86_64 or the dataMemoryTempRegister() on ARM64.  In so doing, we can simplify the silentFill() code and eliminate the bug.

<rdar://problem/31418651>

[Mark Lam]

Created attachment 310700 [details]
proposed patch.

[Mark Lam]

Thanks for the review.  Landed in r217156: <http://trac.webkit.org/r217156>.

[Ryan Haddad]

Reverted r217156 for reason:

This change broke the iOS build.

Committed r217169: <http://trac.webkit.org/changeset/217169>

[Mark Lam]

Created attachment 310735 [details]
Patch for re-landing.

[Mark Lam]

Comment on attachment 310735 [details]
Patch for re-landing.

View in context: https://bugs.webkit.org/attachment.cgi?id=310735&action=review

> Source/JavaScriptCore/ChangeLog:8
> +        Reviewed by NOBODY (OOPS!).
> +

Will remove this before landing.

[Mark Lam]

Landed in r217179: <http://trac.webkit.org/r217179>.