[webkit-reviews] review granted: [Bug 129947] Fix bugs in 32-bit Structure implementation : [Attachment 226195] the patch: still needs a lot of testing.

[bugzilla-daemon at webkit.org]

Mark Hahnenberg <mhahnenberg at apple.com> has granted Mark Lam
<mark.lam at apple.com>'s request for review:
Bug 129947: Fix bugs in 32-bit Structure implementation
https://bugs.webkit.org/show_bug.cgi?id=129947

Attachment 226195: the patch: still needs a lot of testing.
https://bugs.webkit.org/attachment.cgi?id=226195&action=review

------- Additional Comments from Mark Hahnenberg <mhahnenberg at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=226195&action=review


r=me with required changes.

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:4415
> +	       GPRTemporary scratch(this);

This is not correct. You can't start allocating registers after you've already
started doing control flow. You need to allocate this GPR up where the
local/remote global object GPRs are allocated.