Bug 91576 - DFG 32-bit PutById transition stub passes the payload/tag arguments to a DFG operation in the wrong order
Summary: DFG 32-bit PutById transition stub passes the payload/tag arguments to a DFG ...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-07-17 21:36 PDT by Filip Pizlo
Modified: 2012-07-17 21:44 PDT (History)
0 users

See Also:


Attachments
the patch (1.65 KB, patch)
2012-07-17 21:41 PDT, Filip Pizlo
fpizlo: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2012-07-17 21:36:14 PDT
We have a confusing convention where our callOperation() methods in DFG::SpeculativeJIT take the tag GPR first and the payload GPR second, but then reverse them.  The transition stub generation code uses a lower level API where the reversal would already have been performed, but I had modeled the code around the calls to callOperation().  Hence I had gotten it backwards.
Comment 1 Filip Pizlo 2012-07-17 21:41:48 PDT
Created attachment 152916 [details]
the patch
Comment 2 Filip Pizlo 2012-07-17 21:43:34 PDT
Reviewed by Gavin in person.
Comment 3 Filip Pizlo 2012-07-17 21:44:32 PDT
Landed in http://trac.webkit.org/changeset/122919