[Webkit-unassigned] [Bug 157741] JSC: DFG::SpeculativeJIT::compile special case for MIPS for PutByValWithThis
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Thu May 19 09:58:20 PDT 2016
https://bugs.webkit.org/show_bug.cgi?id=157741
--- Comment #13 from Guillaume Emont <guijemont at igalia.com> ---
I spent some time trying to avoid the move, doing the following instead of setting up a JSValueOperand and moving its registers to $a2/$a3:
VirtualRegister virtualRegister = m_jit.graph().varArgChild(node, 0)->virtualRegister();
m_jit.load32(JITCompiler::payloadFor(virtualRegister), GPRInfo::argumentGPR2);
m_jit.load32(JITCompiler::tagFor(virtualRegister), GPRInfo::argumentGPR3);
But then, when I run super-property-access.js, I get this:
# jsc super-property-access.js
Exception: TypeError: Attempted to assign to readonly property.
baz at super-property-access.js:442:23
super-property-access.js:450:16
test at super-property-access.js:9:10
global code at super-property-access.js:429:5
#
I spent some time investigating that but could not really understand what's wrong with that approach. So for now I think we can stick with the latest patch I posted.
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160519/d98bde9f/attachment.html>
More information about the webkit-unassigned
mailing list