[Webkit-unassigned] [Bug 91576] New: DFG 32-bit PutById transition stub passes the payload/tag arguments to a DFG operation in the wrong order

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=91576

           Summary: DFG 32-bit PutById transition stub passes the
                    payload/tag arguments to a DFG operation in the wrong
                    order
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: fpizlo at apple.com


We have a confusing convention where our callOperation() methods in DFG::SpeculativeJIT take the tag GPR first and the payload GPR second, but then reverse them.  The transition stub generation code uses a lower level API where the reversal would already have been performed, but I had modeled the code around the calls to callOperation().  Hence I had gotten it backwards.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.