RESOLVED FIXED Bug 69696
bug fixes for ArrayPush and ArrayPop in 32_64 DFG JIT 
https://bugs.webkit.org/show_bug.cgi?id=69696
Summary bug fixes for ArrayPush and ArrayPop in 32_64 DFG JIT
Yuqiang Xian
Reported 2011-10-07 23:46:26 PDT
On 32-bit, we should use TimesEight (8) instead of ScalePtr (4) to compute the address of a JS array element.
Attachments
the patch (4.22 KB, patch)
2011-10-07 23:49 PDT, Yuqiang Xian 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Yuqiang Xian
Comment 1 2011-10-07 23:49:00 PDT
Created attachment 110262 [details] the patch
Filip Pizlo
Comment 2 2011-10-07 23:49:28 PDT
Oops!
Filip Pizlo
Comment 3 2011-10-07 23:50:28 PDT
r=me Did you want cq+?
Yuqiang Xian
Comment 4 2011-10-07 23:52:12 PDT
Comment on attachment 110262 [details] the patch Yes. Thanks.
WebKit Review Bot
Comment 5 2011-10-08 00:03:12 PDT
Comment on attachment 110262 [details] the patch Clearing flags on attachment: 110262 Committed r97003: <http://trac.webkit.org/changeset/97003>
WebKit Review Bot
Comment 6 2011-10-08 00:03:17 PDT
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.