2009-05-10 Maciej Stachowiak <mjs@apple.com>

        Reviewed by Geoff Garen.

        - fixed REGRESSION(r43432): Many JavaScriptCore tests crash in 64-bit
        https://bugs.webkit.org/show_bug.cgi?id=25680

        Accound for the 64-bit instruction prefix when rewriting mov to lea on 64-bit.

        * jit/JIT.h:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::patchGetByIdSelf):
        (JSC::JIT::patchPutByIdReplace):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@43481 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 30b0de3004611e9529eb77178132c8621ad40a7d..302cb8364864a6d501ff6b8ba10daffdf2536732 100644 (file)
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,17 @@
+2009-05-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff Garen.
+        
+        - fixed REGRESSION(r43432): Many JavaScriptCore tests crash in 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=25680
+
+        Accound for the 64-bit instruction prefix when rewriting mov to lea on 64-bit.
+        
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+
 2009-05-10  Darin Adler  <darin@apple.com>
 
         Reviewed by Cameron Zwarich.

diff --git a/JavaScriptCore/jit/JIT.h b/JavaScriptCore/jit/JIT.h
index 3bd33c0f4d9f99d67aba84a0f711f7e1b6b58e29..53c8a58d4813fe1b1eba54b65b224cfb412d6993 100644 (file)
--- a/JavaScriptCore/jit/JIT.h
+++ b/JavaScriptCore/jit/JIT.h
@@ -228,12 +228,14 @@ namespace JSC {
         static const int patchOffsetPutByIdStructure = 10;
         static const int patchOffsetPutByIdExternalLoad = 20;
         static const int patchLengthPutByIdExternalLoad = 4;
+        static const int patchLengthPutByIdExternalLoadPrefix = 1;
         static const int patchOffsetPutByIdPropertyMapOffset = 31;
         // These architecture specific value are used to enable patching - see comment on op_get_by_id.
         static const int patchOffsetGetByIdStructure = 10;
         static const int patchOffsetGetByIdBranchToSlowCase = 20;
         static const int patchOffsetGetByIdExternalLoad = 20;
         static const int patchLengthGetByIdExternalLoad = 4;
+        static const int patchLengthGetByIdExternalLoadPrefix = 1;
         static const int patchOffsetGetByIdPropertyMapOffset = 31;
         static const int patchOffsetGetByIdPutResult = 31;
 #if ENABLE(OPCODE_SAMPLING)
@@ -247,12 +249,14 @@ namespace JSC {
         static const int patchOffsetPutByIdStructure = 7;
         static const int patchOffsetPutByIdExternalLoad = 13;
         static const int patchLengthPutByIdExternalLoad = 3;
+        static const int patchLengthPutByIdExternalLoadPrefix = 0;
         static const int patchOffsetPutByIdPropertyMapOffset = 22;
         // These architecture specific value are used to enable patching - see comment on op_get_by_id.
         static const int patchOffsetGetByIdStructure = 7;
         static const int patchOffsetGetByIdBranchToSlowCase = 13;
         static const int patchOffsetGetByIdExternalLoad = 13;
         static const int patchLengthGetByIdExternalLoad = 3;
+        static const int patchLengthGetByIdExternalLoadPrefix = 0;
         static const int patchOffsetGetByIdPropertyMapOffset = 22;
         static const int patchOffsetGetByIdPutResult = 22;
 #if ENABLE(OPCODE_SAMPLING)

diff --git a/JavaScriptCore/jit/JITPropertyAccess.cpp b/JavaScriptCore/jit/JITPropertyAccess.cpp
index 6aa758d2fa8ab4ae4e49bb256e450d1a0b5161a1..56190cc01c0e8ca820c53ab1cb5995c29b40f9a9 100644 (file)
--- a/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -330,7 +330,7 @@ void JIT::patchGetByIdSelf(StructureStubInfo* stubInfo, Structure* structure, si
     // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
     // and makes the subsequent load's offset automatically correct
     if (structure->isUsingInlineStorage())
-        stubInfo->hotPathBegin.instructionAtOffset(patchOffsetGetByIdExternalLoad).patchLoadToLEA();
+        stubInfo->hotPathBegin.instructionAtOffset(patchOffsetGetByIdExternalLoad + patchLengthGetByIdExternalLoadPrefix).patchLoadToLEA();
 
     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
     stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetGetByIdStructure).repatch(structure);
@@ -348,7 +348,7 @@ void JIT::patchPutByIdReplace(StructureStubInfo* stubInfo, Structure* structure,
     // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
     // and makes the subsequent load's offset automatically correct
     if (structure->isUsingInlineStorage())
-        stubInfo->hotPathBegin.instructionAtOffset(patchOffsetGetByIdExternalLoad).patchLoadToLEA();
+        stubInfo->hotPathBegin.instructionAtOffset(patchOffsetPutByIdExternalLoad + patchLengthPutByIdExternalLoadPrefix).patchLoadToLEA();
 
     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
     stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetPutByIdStructure).repatch(structure);