RESOLVED FIXED 67804
DFG speculative JIT does not initialize integer tags for PredictInt32 temporaries 
https://bugs.webkit.org/show_bug.cgi?id=67804
Summary DFG speculative JIT does not initialize integer tags for PredictInt32 tempora...
Filip Pizlo
Reported 2011-09-08 14:23:55 PDT
For variables that are PredictInt32, the DFG specualtive JIT does loads and stores on the lower-32-bit payload without boxing and unboxing. This is possible because at the head of the code block, the speculative JIT initializes the tags for all of these variables. But, it neglects to do so for temporaries created by the DFG itself that were then predicted Int32.
Attachments
the patch (1.39 KB, patch)
2011-09-08 14:26 PDT, Filip Pizlo 		fpizlo: commit-queue-
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2011-09-08 14:26:27 PDT
Created attachment 106789 [details] the patch Still running a few tests.
Filip Pizlo
Comment 2 2011-09-08 14:30:36 PDT
Comment on attachment 106789 [details] the patch Looks ready to land.
Filip Pizlo
Comment 3 2011-09-08 14:35:18 PDT
Comment on attachment 106789 [details] the patch Going to land manually.
Filip Pizlo
Comment 4 2011-09-08 14:35:43 PDT
Landed in r94801.
Note You need to log in before you can comment on or make changes to this bug.