[JAEGER] Band-aid to always kill type when killing data. r=dvander, b=580694
authorAndrew Drake <adrake@mozilla.com>
Thu, 22 Jul 2010 17:32:23 -0700
changeset 53151 35c51fe530b6fea305f4c93ff39dabf3ee2914ee
parent 53150 1661c73938c5624129f70823852cfbb5b56c0f76
child 53152 51ed7672df50fbc43858f1235b448160425111f6
push id15660
push userrsayre@mozilla.com
push dateSat, 11 Sep 2010 19:16:24 +0000
treeherdermozilla-central@f1bd314e64ac [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdvander
bugs580694
milestone2.0b2pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
[JAEGER] Band-aid to always kill type when killing data. r=dvander, b=580694
js/src/methodjit/FrameState.cpp
--- a/js/src/methodjit/FrameState.cpp
+++ b/js/src/methodjit/FrameState.cpp
@@ -397,17 +397,17 @@ FrameState::syncAndKill(Registers kill, 
         if (killData) {
             JS_ASSERT(backing == fe);
             JS_ASSERT(fe->data.synced());
             if (regstate[fe->data.reg()].fe)
                 forgetReg(fe->data.reg());
             fe->data.setMemory();
         }
         bool killType = fe->type.inRegister() && kill.hasReg(fe->type.reg());
-        if (!fe->type.synced() && (killType || fe >= bottom)) {
+        if (!fe->type.synced() && (killType || killData || fe >= bottom)) {
             if (backing != fe && backing->type.inMemory())
                 tempRegForType(backing);
             syncType(backing, address, masm);
             fe->type.sync();
         }
         if (killType) {
             JS_ASSERT(backing == fe);
             JS_ASSERT(fe->type.synced());