[Win] JavaScript JIT crash (with DFG enabled).
authormsaboff@apple.com <msaboff@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 21 Nov 2013 00:42:38 +0000 (00:42 +0000)
committermsaboff@apple.com <msaboff@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 21 Nov 2013 00:42:38 +0000 (00:42 +0000)
commite674e54242b9579f65710b964b5eb57a602f66dc
tree55b35081d54a6e62f72769e05c46d40ef8ab127e
parent373a50e44ab0f1906faa2fe29b96138567dd4b4a
[Win] JavaScript JIT crash (with DFG enabled).
https://bugs.webkit.org/show_bug.cgi?id=124675

Reviewed by Geoffrey Garen.

Similar to the change in r159427, changed linkClosureCall to use regT0/regT1 (payload/tag) for the callee.
linkForThunkGenerator already expected the callee in regT0/regT1, but changed the comment to reflect that.

* jit/Repatch.cpp:
(JSC::linkClosureCall):
* jit/ThunkGenerators.cpp:
(JSC::linkForThunkGenerator):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@159593 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/jit/Repatch.cpp
Source/JavaScriptCore/jit/ThunkGenerators.cpp