<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[174090] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/174090">174090</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2014-09-29 15:25:51 -0700 (Mon, 29 Sep 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>Don't use GPRResult unless you're flushing registers and making a runtime function call
https://bugs.webkit.org/show_bug.cgi?id=137234
Rubber stamped by Andreas Kling.
Rename GPRResult to GPRFlushedCallResult, in an attempt to dissuade people from using it for results in the
general case.
Replace GPRResult with GPRTemporary in those places where it was causing bugs: particularly in GetDirectPname it
would cause us to spill the register that has the base, and the code was assuming (rightly) that the base and the
result were in different registers. That's a valid assumption when using GPRTemporary but not with GPRResult.
Also this code wasn't getting any benefit from using GPRResult because it wasn't doing flushRegisters().
I don't know how to test this. A test would require setting up a particularly awkward register allocation state.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileIn):
(JSC::DFG::SpeculativeJIT::compileNewFunctionNoCheck):
(JSC::DFG::SpeculativeJIT::compileNewFunctionExpression):
(JSC::DFG::SpeculativeJIT::compileRegExpExec):
(JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
(JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
(JSC::DFG::SpeculativeJIT::compileToStringOnCell):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::GPRFlushedCallResult::GPRFlushedCallResult):
(JSC::DFG::GPRFlushedCallResult2::GPRFlushedCallResult2):
(JSC::DFG::GPRResult::GPRResult): Deleted.
(JSC::DFG::GPRResult2::GPRResult2): Deleted.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::speculateDoubleRepMachineInt):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITh">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (174089 => 174090)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2014-09-29 22:23:20 UTC (rev 174089)
+++ trunk/Source/JavaScriptCore/ChangeLog 2014-09-29 22:25:51 UTC (rev 174090)
</span><span class="lines">@@ -1,3 +1,45 @@
</span><ins>+2014-09-29 Filip Pizlo <fpizlo@apple.com>
+
+ Don't use GPRResult unless you're flushing registers and making a runtime function call
+ https://bugs.webkit.org/show_bug.cgi?id=137234
+
+ Rubber stamped by Andreas Kling.
+
+ Rename GPRResult to GPRFlushedCallResult, in an attempt to dissuade people from using it for results in the
+ general case.
+
+ Replace GPRResult with GPRTemporary in those places where it was causing bugs: particularly in GetDirectPname it
+ would cause us to spill the register that has the base, and the code was assuming (rightly) that the base and the
+ result were in different registers. That's a valid assumption when using GPRTemporary but not with GPRResult.
+ Also this code wasn't getting any benefit from using GPRResult because it wasn't doing flushRegisters().
+
+ I don't know how to test this. A test would require setting up a particularly awkward register allocation state.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileIn):
+ (JSC::DFG::SpeculativeJIT::compileNewFunctionNoCheck):
+ (JSC::DFG::SpeculativeJIT::compileNewFunctionExpression):
+ (JSC::DFG::SpeculativeJIT::compileRegExpExec):
+ (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+ (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+ (JSC::DFG::SpeculativeJIT::compileToStringOnCell):
+ * dfg/DFGSpeculativeJIT.h:
+ (JSC::DFG::GPRFlushedCallResult::GPRFlushedCallResult):
+ (JSC::DFG::GPRFlushedCallResult2::GPRFlushedCallResult2):
+ (JSC::DFG::GPRResult::GPRResult): Deleted.
+ (JSC::DFG::GPRResult2::GPRResult2): Deleted.
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+ (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+ (JSC::DFG::SpeculativeJIT::emitCall):
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+ (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+ (JSC::DFG::SpeculativeJIT::emitCall):
+ (JSC::DFG::SpeculativeJIT::compile):
+ (JSC::DFG::SpeculativeJIT::speculateDoubleRepMachineInt):
+
</ins><span class="cx"> 2014-09-29 Diego Pino Garcia <dpino@igalia.com>
</span><span class="cx">
</span><span class="cx"> Missing changes from r174049
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (174089 => 174090)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2014-09-29 22:23:20 UTC (rev 174089)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2014-09-29 22:25:51 UTC (rev 174090)
</span><span class="lines">@@ -899,7 +899,7 @@
</span><span class="cx"> JSValueOperand key(this, node->child1());
</span><span class="cx"> JSValueRegs regs = key.jsValueRegs();
</span><span class="cx">
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> base.use();
</span><span class="lines">@@ -4154,7 +4154,7 @@
</span><span class="cx">
</span><span class="cx"> void SpeculativeJIT::compileNewFunctionNoCheck(Node* node)
</span><span class="cx"> {
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx"> flushRegisters();
</span><span class="cx"> callOperation(
</span><span class="lines">@@ -4164,7 +4164,7 @@
</span><span class="cx">
</span><span class="cx"> void SpeculativeJIT::compileNewFunctionExpression(Node* node)
</span><span class="cx"> {
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx"> flushRegisters();
</span><span class="cx"> callOperation(
</span><span class="lines">@@ -4199,7 +4199,7 @@
</span><span class="cx"> GPRReg argumentGPR = argument.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> callOperation(operationRegExpTest, result.gpr(), baseGPR, argumentGPR);
</span><span class="cx">
</span><span class="cx"> branchTest32(invert ? JITCompiler::Zero : JITCompiler::NonZero, result.gpr(), taken);
</span><span class="lines">@@ -4222,7 +4222,7 @@
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><span class="cx">
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> callOperation(operationReallocateButterflyToHavePropertyStorageWithInitialCapacity, result.gpr(), baseGPR);
</span><span class="cx">
</span><span class="cx"> storageResult(result.gpr(), node);
</span><span class="lines">@@ -4265,7 +4265,7 @@
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><span class="cx">
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> callOperation(operationReallocateButterflyToGrowPropertyStorage, result.gpr(), baseGPR, newSize / sizeof(JSValue));
</span><span class="cx">
</span><span class="cx"> storageResult(result.gpr(), node);
</span><span class="lines">@@ -4354,7 +4354,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case CellUse: {
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> // We flush registers instead of silent spill/fill because in this mode we
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h (174089 => 174090)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h 2014-09-29 22:23:20 UTC (rev 174089)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h 2014-09-29 22:25:51 UTC (rev 174090)
</span><span class="lines">@@ -2690,18 +2690,18 @@
</span><span class="cx"> //
</span><span class="cx"> // These classes lock the result of a call to a C++ helper function.
</span><span class="cx">
</span><del>-class GPRResult : public GPRTemporary {
</del><ins>+class GPRFlushedCallResult : public GPRTemporary {
</ins><span class="cx"> public:
</span><del>- GPRResult(SpeculativeJIT* jit)
</del><ins>+ GPRFlushedCallResult(SpeculativeJIT* jit)
</ins><span class="cx"> : GPRTemporary(jit, GPRInfo::returnValueGPR)
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> #if USE(JSVALUE32_64)
</span><del>-class GPRResult2 : public GPRTemporary {
</del><ins>+class GPRFlushedCallResult2 : public GPRTemporary {
</ins><span class="cx"> public:
</span><del>- GPRResult2(SpeculativeJIT* jit)
</del><ins>+ GPRFlushedCallResult2(SpeculativeJIT* jit)
</ins><span class="cx"> : GPRTemporary(jit, GPRInfo::returnValueGPR2)
</span><span class="cx"> {
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (174089 => 174090)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2014-09-29 22:23:20 UTC (rev 174089)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2014-09-29 22:25:51 UTC (rev 174090)
</span><span class="lines">@@ -396,7 +396,7 @@
</span><span class="cx"> JITCompiler::JumpList slowPath;
</span><span class="cx">
</span><span class="cx"> if (isKnownNotInteger(node->child1().node()) || isKnownNotInteger(node->child2().node())) {
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> arg1.use();
</span><span class="lines">@@ -487,7 +487,7 @@
</span><span class="cx"> JITCompiler::JumpList slowPath;
</span><span class="cx">
</span><span class="cx"> if (isKnownNotInteger(node->child1().node()) || isKnownNotInteger(node->child2().node())) {
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultPayloadGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> arg1.use();
</span><span class="lines">@@ -677,8 +677,8 @@
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><span class="cx">
</span><del>- GPRResult resultPayload(this);
- GPRResult2 resultTag(this);
</del><ins>+ GPRFlushedCallResult resultPayload(this);
+ GPRFlushedCallResult2 resultTag(this);
</ins><span class="cx"> GPRReg resultPayloadGPR = resultPayload.gpr();
</span><span class="cx"> GPRReg resultTagGPR = resultTag.gpr();
</span><span class="cx">
</span><span class="lines">@@ -1943,8 +1943,8 @@
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><span class="cx">
</span><del>- GPRResult2 resultTag(this);
- GPRResult resultPayload(this);
</del><ins>+ GPRFlushedCallResult2 resultTag(this);
+ GPRFlushedCallResult resultPayload(this);
</ins><span class="cx"> if (isKnownNotNumber(node->child1().node()) || isKnownNotNumber(node->child2().node()))
</span><span class="cx"> callOperation(operationValueAddNotNumber, resultTag.gpr(), resultPayload.gpr(), op1TagGPR, op1PayloadGPR, op2TagGPR, op2PayloadGPR);
</span><span class="cx"> else
</span><span class="lines">@@ -2217,8 +2217,8 @@
</span><span class="cx"> GPRReg propertyPayloadGPR = property.payloadGPR();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><del>- GPRResult2 resultTag(this);
- GPRResult resultPayload(this);
</del><ins>+ GPRFlushedCallResult2 resultTag(this);
+ GPRFlushedCallResult resultPayload(this);
</ins><span class="cx"> callOperation(operationGetByValCell, resultTag.gpr(), resultPayload.gpr(), baseGPR, propertyTagGPR, propertyPayloadGPR);
</span><span class="cx">
</span><span class="cx"> jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
</span><span class="lines">@@ -2616,7 +2616,7 @@
</span><span class="cx"> GPRReg argumentGPR = argument.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> callOperation(operationRegExpTest, result.gpr(), baseGPR, argumentGPR);
</span><span class="cx">
</span><span class="cx"> // Must use jsValueResult because otherwise we screw up register
</span><span class="lines">@@ -2631,8 +2631,8 @@
</span><span class="cx"> GPRReg argumentGPR = argument.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><del>- GPRResult2 resultTag(this);
- GPRResult resultPayload(this);
</del><ins>+ GPRFlushedCallResult2 resultTag(this);
+ GPRFlushedCallResult resultPayload(this);
</ins><span class="cx"> callOperation(operationRegExpExec, resultTag.gpr(), resultPayload.gpr(), baseGPR, argumentGPR);
</span><span class="cx">
</span><span class="cx"> jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
</span><span class="lines">@@ -2646,7 +2646,7 @@
</span><span class="cx"> GPRReg argumentGPR = argument.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> callOperation(operationRegExpTest, result.gpr(), baseGPR, argumentGPR);
</span><span class="cx">
</span><span class="cx"> // If we add a DataFormatBool, we should use it here.
</span><span class="lines">@@ -3035,7 +3035,7 @@
</span><span class="cx"> GPRReg op1PayloadGPR = op1.payloadGPR();
</span><span class="cx"> GPRReg op1TagGPR = op1.tagGPR();
</span><span class="cx">
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><span class="lines">@@ -3144,7 +3144,7 @@
</span><span class="cx">
</span><span class="cx"> if (!node->numChildren()) {
</span><span class="cx"> flushRegisters();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> callOperation(
</span><span class="cx"> operationNewEmptyArray, result.gpr(), globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()));
</span><span class="cx"> cellResult(result.gpr(), node);
</span><span class="lines">@@ -3219,7 +3219,7 @@
</span><span class="cx"> m_jit.storePtr(TrustedImmPtr(scratchSize), scratch.gpr());
</span><span class="cx"> }
</span><span class="cx">
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx">
</span><span class="cx"> callOperation(
</span><span class="cx"> operationNewArray, result.gpr(), globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()),
</span><span class="lines">@@ -3294,7 +3294,7 @@
</span><span class="cx"> SpeculateStrictInt32Operand size(this, node->child1());
</span><span class="cx"> GPRReg sizeGPR = size.gpr();
</span><span class="cx"> flushRegisters();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx"> GPRReg structureGPR = selectScratchGPR(sizeGPR);
</span><span class="cx"> MacroAssembler::Jump bigLength = m_jit.branch32(MacroAssembler::AboveOrEqual, sizeGPR, TrustedImm32(MIN_SPARSE_ARRAY_INDEX));
</span><span class="lines">@@ -3347,7 +3347,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx">
</span><span class="cx"> callOperation(operationNewArrayBuffer, result.gpr(), globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()), node->startConstant(), node->numConstants());
</span><span class="cx">
</span><span class="lines">@@ -3367,7 +3367,7 @@
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><span class="cx">
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
</span><span class="lines">@@ -3388,8 +3388,8 @@
</span><span class="cx">
</span><span class="cx"> case NewRegexp: {
</span><span class="cx"> flushRegisters();
</span><del>- GPRResult resultPayload(this);
- GPRResult2 resultTag(this);
</del><ins>+ GPRFlushedCallResult resultPayload(this);
+ GPRFlushedCallResult2 resultTag(this);
</ins><span class="cx">
</span><span class="cx"> callOperation(operationNewRegexp, resultTag.gpr(), resultPayload.gpr(), m_jit.codeBlock()->regexp(node->regexpIndex()));
</span><span class="cx">
</span><span class="lines">@@ -3631,8 +3631,8 @@
</span><span class="cx">
</span><span class="cx"> GPRReg baseGPR = base.gpr();
</span><span class="cx">
</span><del>- GPRResult resultPayload(this);
- GPRResult2 resultTag(this);
</del><ins>+ GPRFlushedCallResult resultPayload(this);
+ GPRFlushedCallResult2 resultTag(this);
</ins><span class="cx"> GPRReg resultPayloadGPR = resultPayload.gpr();
</span><span class="cx"> GPRReg resultTagGPR = resultTag.gpr();
</span><span class="cx">
</span><span class="lines">@@ -3651,8 +3651,8 @@
</span><span class="cx"> GPRReg baseTagGPR = base.tagGPR();
</span><span class="cx"> GPRReg basePayloadGPR = base.payloadGPR();
</span><span class="cx">
</span><del>- GPRResult resultPayload(this);
- GPRResult2 resultTag(this);
</del><ins>+ GPRFlushedCallResult resultPayload(this);
+ GPRFlushedCallResult2 resultTag(this);
</ins><span class="cx"> GPRReg resultPayloadGPR = resultPayload.gpr();
</span><span class="cx"> GPRReg resultTagGPR = resultTag.gpr();
</span><span class="cx">
</span><span class="lines">@@ -4075,7 +4075,7 @@
</span><span class="cx"> JSValueOperand value(this, node->child1());
</span><span class="cx"> GPRReg valueTagGPR = value.tagGPR();
</span><span class="cx"> GPRReg valuePayloadGPR = value.payloadGPR();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx"> flushRegisters();
</span><span class="cx"> callOperation(operationIsObject, resultGPR, valueTagGPR, valuePayloadGPR);
</span><span class="lines">@@ -4087,7 +4087,7 @@
</span><span class="cx"> JSValueOperand value(this, node->child1());
</span><span class="cx"> GPRReg valueTagGPR = value.tagGPR();
</span><span class="cx"> GPRReg valuePayloadGPR = value.payloadGPR();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx"> flushRegisters();
</span><span class="cx"> callOperation(operationIsFunction, resultGPR, valueTagGPR, valuePayloadGPR);
</span><span class="lines">@@ -4100,7 +4100,7 @@
</span><span class="cx"> GPRReg payloadGPR = value.payloadGPR();
</span><span class="cx"> GPRTemporary temp(this);
</span><span class="cx"> GPRReg tempGPR = temp.gpr();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx"> JITCompiler::JumpList doneJumps;
</span><span class="cx">
</span><span class="lines">@@ -4597,7 +4597,7 @@
</span><span class="cx">
</span><span class="cx"> case GetEnumerableLength: {
</span><span class="cx"> SpeculateCellOperand base(this, node->child1());
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><span class="lines">@@ -4608,8 +4608,8 @@
</span><span class="cx"> case HasGenericProperty: {
</span><span class="cx"> JSValueOperand base(this, node->child1());
</span><span class="cx"> SpeculateCellOperand property(this, node->child2());
</span><del>- GPRResult resultPayload(this);
- GPRResult2 resultTag(this);
</del><ins>+ GPRFlushedCallResult resultPayload(this);
+ GPRFlushedCallResult2 resultTag(this);
</ins><span class="cx"> GPRReg basePayloadGPR = base.payloadGPR();
</span><span class="cx"> GPRReg baseTagGPR = base.tagGPR();
</span><span class="cx"> GPRReg resultPayloadGPR = resultPayload.gpr();
</span><span class="lines">@@ -4625,8 +4625,8 @@
</span><span class="cx"> SpeculateCellOperand property(this, node->child2());
</span><span class="cx"> SpeculateCellOperand enumerator(this, node->child3());
</span><span class="cx"> GPRTemporary scratch(this);
</span><del>- GPRResult resultPayload(this);
- GPRResult2 resultTag(this);
</del><ins>+ GPRTemporary resultPayload(this);
+ GPRTemporary resultTag(this);
</ins><span class="cx">
</span><span class="cx"> GPRReg baseTagGPR = base.tagGPR();
</span><span class="cx"> GPRReg basePayloadGPR = base.payloadGPR();
</span><span class="lines">@@ -4652,8 +4652,8 @@
</span><span class="cx"> case HasIndexedProperty: {
</span><span class="cx"> SpeculateCellOperand base(this, node->child1());
</span><span class="cx"> SpeculateInt32Operand index(this, node->child2());
</span><del>- GPRResult resultPayload(this);
- GPRResult2 resultTag(this);
</del><ins>+ GPRTemporary resultPayload(this);
+ GPRTemporary resultTag(this);
</ins><span class="cx">
</span><span class="cx"> GPRReg baseGPR = base.gpr();
</span><span class="cx"> GPRReg indexGPR = index.gpr();
</span><span class="lines">@@ -4723,22 +4723,31 @@
</span><span class="cx">
</span><span class="cx"> SpeculateCellOperand base(this, baseEdge);
</span><span class="cx"> SpeculateCellOperand property(this, propertyEdge);
</span><del>- GPRResult resultPayload(this);
- GPRResult2 resultTag(this);
</del><ins>+ GPRReg baseGPR = base.gpr();
+ GPRReg propertyGPR = property.gpr();
+
+#if CPU(X86)
+ GPRFlushedCallResult resultPayload(this);
+ GPRFlushedCallResult2 resultTag(this);
</ins><span class="cx"> GPRTemporary scratch(this);
</span><span class="cx">
</span><del>- GPRReg baseGPR = base.gpr();
- GPRReg propertyGPR = property.gpr();
</del><span class="cx"> GPRReg resultTagGPR = resultTag.gpr();
</span><span class="cx"> GPRReg resultPayloadGPR = resultPayload.gpr();
</span><span class="cx"> GPRReg scratchGPR = scratch.gpr();
</span><span class="cx">
</span><del>-#if CPU(X86)
</del><span class="cx"> // Not enough registers on X86 for this code, so always use the slow path.
</span><span class="cx"> flushRegisters();
</span><span class="cx"> m_jit.move(MacroAssembler::TrustedImm32(JSValue::CellTag), scratchGPR);
</span><span class="cx"> callOperation(operationGetByValCell, resultTagGPR, resultPayloadGPR, baseGPR, scratchGPR, propertyGPR);
</span><span class="cx"> #else
</span><ins>+ GPRTemporary resultPayload(this);
+ GPRTemporary resultTag(this);
+ GPRTemporary scratch(this);
+
+ GPRReg resultTagGPR = resultTag.gpr();
+ GPRReg resultPayloadGPR = resultPayload.gpr();
+ GPRReg scratchGPR = scratch.gpr();
+
</ins><span class="cx"> Edge& indexEdge = m_jit.graph().varArgChild(node, 2);
</span><span class="cx"> Edge& enumeratorEdge = m_jit.graph().varArgChild(node, 3);
</span><span class="cx">
</span><span class="lines">@@ -4789,7 +4798,7 @@
</span><span class="cx"> case GetStructurePropertyEnumerator: {
</span><span class="cx"> SpeculateCellOperand base(this, node->child1());
</span><span class="cx"> SpeculateInt32Operand length(this, node->child2());
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><span class="lines">@@ -4801,7 +4810,7 @@
</span><span class="cx"> SpeculateCellOperand base(this, node->child1());
</span><span class="cx"> SpeculateInt32Operand length(this, node->child2());
</span><span class="cx"> SpeculateCellOperand enumerator(this, node->child3());
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><span class="lines">@@ -4813,8 +4822,8 @@
</span><span class="cx"> SpeculateCellOperand enumerator(this, node->child1());
</span><span class="cx"> SpeculateInt32Operand index(this, node->child2());
</span><span class="cx"> GPRTemporary scratch(this);
</span><del>- GPRResult resultPayload(this);
- GPRResult2 resultTag(this);
</del><ins>+ GPRTemporary resultPayload(this);
+ GPRTemporary resultTag(this);
</ins><span class="cx">
</span><span class="cx"> GPRReg enumeratorGPR = enumerator.gpr();
</span><span class="cx"> GPRReg indexGPR = index.gpr();
</span><span class="lines">@@ -4841,7 +4850,7 @@
</span><span class="cx"> }
</span><span class="cx"> case ToIndexString: {
</span><span class="cx"> SpeculateInt32Operand index(this, node->child1());
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (174089 => 174090)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2014-09-29 22:23:20 UTC (rev 174089)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2014-09-29 22:25:51 UTC (rev 174090)
</span><span class="lines">@@ -354,7 +354,7 @@
</span><span class="cx"> JITCompiler::JumpList slowPath;
</span><span class="cx">
</span><span class="cx"> if (isKnownNotInteger(node->child1().node()) || isKnownNotInteger(node->child2().node())) {
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> arg1.use();
</span><span class="lines">@@ -437,7 +437,7 @@
</span><span class="cx"> JITCompiler::JumpList slowPath;
</span><span class="cx">
</span><span class="cx"> if (isKnownNotInteger(node->child1().node()) || isKnownNotInteger(node->child2().node())) {
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> arg1.use();
</span><span class="lines">@@ -661,7 +661,7 @@
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><span class="cx">
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> JITCompiler::DataLabelPtr targetToCheck;
</span><span class="lines">@@ -2043,7 +2043,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case MachineIntUse: {
</span><del>- GPRResult result(this);
</del><ins>+ GPRTemporary result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> convertMachineInt(node->child1(), resultGPR);
</span><span class="lines">@@ -2056,7 +2056,7 @@
</span><span class="cx"> SpeculateDoubleOperand value(this, node->child1());
</span><span class="cx"> FPRReg valueFPR = value.fpr();
</span><span class="cx">
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><span class="lines">@@ -2088,7 +2088,7 @@
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><span class="cx">
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> if (isKnownNotNumber(node->child1().node()) || isKnownNotNumber(node->child2().node()))
</span><span class="cx"> callOperation(operationValueAddNotNumber, result.gpr(), op1GPR, op2GPR);
</span><span class="cx"> else
</span><span class="lines">@@ -2352,7 +2352,7 @@
</span><span class="cx"> GPRReg propertyGPR = property.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> callOperation(operationGetByVal, result.gpr(), baseGPR, propertyGPR);
</span><span class="cx">
</span><span class="cx"> jsValueResult(result.gpr(), node);
</span><span class="lines">@@ -2810,7 +2810,7 @@
</span><span class="cx"> GPRReg argumentGPR = argument.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> callOperation(operationRegExpTest, result.gpr(), baseGPR, argumentGPR);
</span><span class="cx">
</span><span class="cx"> // Must use jsValueResult because otherwise we screw up register
</span><span class="lines">@@ -2825,7 +2825,7 @@
</span><span class="cx"> GPRReg argumentGPR = argument.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> callOperation(operationRegExpExec, result.gpr(), baseGPR, argumentGPR);
</span><span class="cx">
</span><span class="cx"> jsValueResult(result.gpr(), node);
</span><span class="lines">@@ -2839,7 +2839,7 @@
</span><span class="cx"> GPRReg argumentGPR = argument.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> callOperation(operationRegExpTest, result.gpr(), baseGPR, argumentGPR);
</span><span class="cx">
</span><span class="cx"> // If we add a DataFormatBool, we should use it here.
</span><span class="lines">@@ -3157,7 +3157,7 @@
</span><span class="cx"> JSValueOperand op1(this, node->child1());
</span><span class="cx"> GPRReg op1GPR = op1.gpr();
</span><span class="cx">
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><span class="lines">@@ -3265,7 +3265,7 @@
</span><span class="cx">
</span><span class="cx"> if (!node->numChildren()) {
</span><span class="cx"> flushRegisters();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> callOperation(operationNewEmptyArray, result.gpr(), globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()));
</span><span class="cx"> cellResult(result.gpr(), node);
</span><span class="cx"> break;
</span><span class="lines">@@ -3344,7 +3344,7 @@
</span><span class="cx"> m_jit.storePtr(TrustedImmPtr(scratchSize), scratch.gpr());
</span><span class="cx"> }
</span><span class="cx">
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx">
</span><span class="cx"> callOperation(
</span><span class="cx"> operationNewArray, result.gpr(), globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()),
</span><span class="lines">@@ -3417,7 +3417,7 @@
</span><span class="cx"> SpeculateStrictInt32Operand size(this, node->child1());
</span><span class="cx"> GPRReg sizeGPR = size.gpr();
</span><span class="cx"> flushRegisters();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx"> GPRReg structureGPR = selectScratchGPR(sizeGPR);
</span><span class="cx"> MacroAssembler::Jump bigLength = m_jit.branch32(MacroAssembler::AboveOrEqual, sizeGPR, TrustedImm32(MIN_SPARSE_ARRAY_INDEX));
</span><span class="lines">@@ -3467,7 +3467,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx">
</span><span class="cx"> callOperation(operationNewArrayBuffer, result.gpr(), globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()), node->startConstant(), node->numConstants());
</span><span class="cx">
</span><span class="lines">@@ -3486,7 +3486,7 @@
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><span class="cx">
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
</span><span class="lines">@@ -3507,7 +3507,7 @@
</span><span class="cx">
</span><span class="cx"> case NewRegexp: {
</span><span class="cx"> flushRegisters();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx">
</span><span class="cx"> callOperation(operationNewRegexp, result.gpr(), m_jit.codeBlock()->regexp(node->regexpIndex()));
</span><span class="cx">
</span><span class="lines">@@ -3730,7 +3730,7 @@
</span><span class="cx"> SpeculateCellOperand base(this, node->child1());
</span><span class="cx"> GPRReg baseGPR = base.gpr();
</span><span class="cx">
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx">
</span><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="lines">@@ -3748,7 +3748,7 @@
</span><span class="cx"> JSValueOperand base(this, node->child1());
</span><span class="cx"> GPRReg baseGPR = base.gpr();
</span><span class="cx">
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> base.use();
</span><span class="lines">@@ -4142,7 +4142,7 @@
</span><span class="cx"> case IsObject: {
</span><span class="cx"> JSValueOperand value(this, node->child1());
</span><span class="cx"> GPRReg valueGPR = value.gpr();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx"> flushRegisters();
</span><span class="cx"> callOperation(operationIsObject, resultGPR, valueGPR);
</span><span class="lines">@@ -4154,7 +4154,7 @@
</span><span class="cx"> case IsFunction: {
</span><span class="cx"> JSValueOperand value(this, node->child1());
</span><span class="cx"> GPRReg valueGPR = value.gpr();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx"> flushRegisters();
</span><span class="cx"> callOperation(operationIsFunction, resultGPR, valueGPR);
</span><span class="lines">@@ -4166,7 +4166,7 @@
</span><span class="cx"> case TypeOf: {
</span><span class="cx"> JSValueOperand value(this, node->child1(), ManualOperandSpeculation);
</span><span class="cx"> GPRReg valueGPR = value.gpr();
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx"> JITCompiler::JumpList doneJumps;
</span><span class="cx">
</span><span class="lines">@@ -4668,7 +4668,7 @@
</span><span class="cx">
</span><span class="cx"> case GetEnumerableLength: {
</span><span class="cx"> SpeculateCellOperand base(this, node->child1());
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><span class="lines">@@ -4679,7 +4679,7 @@
</span><span class="cx"> case HasGenericProperty: {
</span><span class="cx"> JSValueOperand base(this, node->child1());
</span><span class="cx"> SpeculateCellOperand property(this, node->child2());
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><span class="lines">@@ -4692,7 +4692,7 @@
</span><span class="cx"> SpeculateCellOperand property(this, node->child2());
</span><span class="cx"> SpeculateCellOperand enumerator(this, node->child3());
</span><span class="cx"> GPRTemporary scratch(this);
</span><del>- GPRResult result(this);
</del><ins>+ GPRTemporary result(this);
</ins><span class="cx">
</span><span class="cx"> GPRReg baseGPR = base.gpr();
</span><span class="cx"> GPRReg propertyGPR = property.gpr();
</span><span class="lines">@@ -4716,7 +4716,7 @@
</span><span class="cx"> case HasIndexedProperty: {
</span><span class="cx"> SpeculateCellOperand base(this, node->child1());
</span><span class="cx"> SpeculateStrictInt32Operand index(this, node->child2());
</span><del>- GPRResult result(this);
</del><ins>+ GPRTemporary result(this);
</ins><span class="cx">
</span><span class="cx"> GPRReg baseGPR = base.gpr();
</span><span class="cx"> GPRReg indexGPR = index.gpr();
</span><span class="lines">@@ -4802,7 +4802,7 @@
</span><span class="cx"> SpeculateCellOperand property(this, propertyEdge);
</span><span class="cx"> SpeculateStrictInt32Operand index(this, indexEdge);
</span><span class="cx"> SpeculateCellOperand enumerator(this, enumeratorEdge);
</span><del>- GPRResult result(this);
</del><ins>+ GPRTemporary result(this);
</ins><span class="cx"> GPRTemporary scratch1(this);
</span><span class="cx"> GPRTemporary scratch2(this);
</span><span class="cx">
</span><span class="lines">@@ -4848,7 +4848,7 @@
</span><span class="cx"> case GetStructurePropertyEnumerator: {
</span><span class="cx"> SpeculateCellOperand base(this, node->child1());
</span><span class="cx"> SpeculateInt32Operand length(this, node->child2());
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><span class="lines">@@ -4860,7 +4860,7 @@
</span><span class="cx"> SpeculateCellOperand base(this, node->child1());
</span><span class="cx"> SpeculateInt32Operand length(this, node->child2());
</span><span class="cx"> SpeculateCellOperand enumerator(this, node->child3());
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><span class="lines">@@ -4872,7 +4872,7 @@
</span><span class="cx"> SpeculateCellOperand enumerator(this, node->child1());
</span><span class="cx"> SpeculateStrictInt32Operand index(this, node->child2());
</span><span class="cx"> GPRTemporary scratch1(this);
</span><del>- GPRResult result(this);
</del><ins>+ GPRTemporary result(this);
</ins><span class="cx">
</span><span class="cx"> GPRReg enumeratorGPR = enumerator.gpr();
</span><span class="cx"> GPRReg indexGPR = index.gpr();
</span><span class="lines">@@ -4896,7 +4896,7 @@
</span><span class="cx"> }
</span><span class="cx"> case ToIndexString: {
</span><span class="cx"> SpeculateInt32Operand index(this, node->child1());
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span><span class="lines">@@ -5112,7 +5112,7 @@
</span><span class="cx"> SpeculateDoubleOperand value(this, edge);
</span><span class="cx"> FPRReg valueFPR = value.fpr();
</span><span class="cx">
</span><del>- GPRResult result(this);
</del><ins>+ GPRFlushedCallResult result(this);
</ins><span class="cx"> GPRReg resultGPR = result.gpr();
</span><span class="cx">
</span><span class="cx"> flushRegisters();
</span></span></pre>
</div>
</div>
</body>
</html>