Bug 194446 – Fix DFG's doesGC() for CheckTierUp*, GetByVal, PutByVal*, and StringCharAt nodes.

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Mark Lam]

Patch coming.

[Radar WebKit Bug Importer]

<rdar://problem/47926792>

[Mark Lam]

Created attachment 361529 [details]
proposed patch.

[Saam Barati]

Comment on attachment 361529 [details]
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=361529&action=review

r=me

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2197
>      JITCompiler::Jump bigCharacter =
> -        m_jit.branch32(MacroAssembler::AboveOrEqual, scratchReg, TrustedImm32(0x100));
> +        m_jit.branch32(MacroAssembler::Above, scratchReg, TrustedImm32(maxSingleCharacterString));

This really doesn't belong in this patch.

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:6615
> +            m_out.above(char16BitValue, m_out.constInt32(maxSingleCharacterString)),

ditto

[Mark Lam]

Comment on attachment 361529 [details]
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=361529&action=review

Thanks for the review.

>> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2197
>> +        m_jit.branch32(MacroAssembler::Above, scratchReg, TrustedImm32(maxSingleCharacterString));
> 
> This really doesn't belong in this patch.

I'll revert and apply this in a separate patch.

>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:6615
>> +            m_out.above(char16BitValue, m_out.constInt32(maxSingleCharacterString)),
> 
> ditto

Same.

[Mark Lam]

Landed in r241210: <http://trac.webkit.org/r241210>.