wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Fix isNotType() usage in jsop_rhs_unknown_any(). b=593554, r=dvander.

Browse Source
This commit is contained in:
Sean Stangl 2010-09-07 21:05:01 -04:00
parent 9ad1a53de1
commit 5bd7a0bd53
2 changed files with 21 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
js/src/methodjit/FastOps.cpp
View File

@ -194,28 +194,27 @@ mjit::Compiler::jsop_rsh_int_unknown(FrameEntry *lhs, FrameEntry *rhs)
void
mjit::Compiler::jsop_rsh_unknown_any(FrameEntry *lhs, FrameEntry *rhs)
{
RegisterID rhsData = rightRegForShift(rhs);
JS_ASSERT(!lhs->isTypeKnown() && !rhs->isTypeKnown());
MaybeRegisterID rhsType;
if (rhs->isNotType(JSVAL_TYPE_INT32)) {
rhsType.setReg(frame.tempRegForType(rhs));
frame.pinReg(rhsType.reg());
}
/* Allocate registers. */
RegisterID rhsData = rightRegForShift(rhs);
RegisterID rhsType = frame.tempRegForType(rhs);
frame.pinReg(rhsType);
RegisterID lhsType = frame.tempRegForType(lhs);
frame.pinReg(lhsType);
RegisterID lhsData = frame.copyDataIntoReg(lhs);
frame.unpinReg(lhsType);
if (rhsType.isSet())
frame.unpinReg(rhsType.reg());
MaybeJump rhsIntGuard;
if (rhs->isNotType(JSVAL_TYPE_INT32))
rhsIntGuard.setJump(masm.testInt32(Assembler::NotEqual, rhsType.reg()));
/* Non-integer rhs jumps to stub. */
Jump rhsIntGuard = masm.testInt32(Assembler::NotEqual, rhsType);
frame.unpinReg(rhsType);
/* Non-integer lhs goes to double guard. */
Jump lhsIntGuard = masm.testInt32(Assembler::NotEqual, lhsType);
stubcc.linkExitDirect(lhsIntGuard, stubcc.masm.label());
/* Attempt to convert lhs double to int32. */
Jump lhsDoubleGuard = stubcc.masm.testDouble(Assembler::NotEqual, lhsType);
frame.loadDouble(lhs, FPRegisters::First, stubcc.masm);
Jump lhsTruncateGuard = stubcc.masm.branchTruncateDoubleToInt32(FPRegisters::First, lhsData);
@ -224,12 +223,13 @@ mjit::Compiler::jsop_rsh_unknown_any(FrameEntry *lhs, FrameEntry *rhs)
lhsDoubleGuard.linkTo(stubcc.masm.label(), &stubcc.masm);
lhsTruncateGuard.linkTo(stubcc.masm.label(), &stubcc.masm);
if (rhsIntGuard.isSet())
stubcc.linkExitDirect(rhsIntGuard.getJump(), stubcc.masm.label());
stubcc.linkExitDirect(rhsIntGuard, stubcc.masm.label());
frame.sync(stubcc.masm, Uses(2));
stubcc.call(stubs::Rsh);
masm.rshift32(rhsData, lhsData);
frame.freeReg(rhsData);
frame.popn(2);
frame.pushTypedPayload(JSVAL_TYPE_INT32, lhsData);

8
js/src/trace-test/tests/jaeger/bug593554.js Normal file
View File

@ -0,0 +1,8 @@
/* Don't assert. */
var b = 7;
var a = [];
for (var j = 0; j < 7; ++j) {
var d = {};
a.push(b >> d);
}
assertEq(a.toString(), "7,7,7,7,7,7,7");