Bug 69696 - bug fixes for ArrayPush and ArrayPop in 32_64 DFG JIT
Summary: bug fixes for ArrayPush and ArrayPop in 32_64 DFG JIT
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-10-07 23:46 PDT by Yuqiang Xian
Modified: 2011-10-08 00:03 PDT (History)
3 users (show)

See Also:


Attachments
the patch (4.22 KB, patch)
2011-10-07 23:49 PDT, Yuqiang Xian
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Yuqiang Xian 2011-10-07 23:46:26 PDT
On 32-bit, we should use TimesEight (8) instead of ScalePtr (4) to compute the address of a JS array element.
Comment 1 Yuqiang Xian 2011-10-07 23:49:00 PDT
Created attachment 110262 [details]
the patch
Comment 2 Filip Pizlo 2011-10-07 23:49:28 PDT
Oops!
Comment 3 Filip Pizlo 2011-10-07 23:50:28 PDT
r=me

Did you want cq+?
Comment 4 Yuqiang Xian 2011-10-07 23:52:12 PDT
Comment on attachment 110262 [details]
the patch

Yes. Thanks.
Comment 5 WebKit Review Bot 2011-10-08 00:03:12 PDT
Comment on attachment 110262 [details]
the patch

Clearing flags on attachment: 110262

Committed r97003: <http://trac.webkit.org/changeset/97003>
Comment 6 WebKit Review Bot 2011-10-08 00:03:17 PDT
All reviewed patches have been landed.  Closing bug.