Fix register allocation around inline returns, bug 713209.
☠☠ backed out by f623372c6de0 ☠ ☠
authorBrian Hackett <>
Tue, 27 Dec 2011 17:03:06 -0700
changeset 84642 d10b118890e4fb2bc4f1127e6291f104720603fb
parent 84641 4fb24658d1f2b0c62ad3da8e4c3823ac878b6e91
child 84643 f623372c6de09ef08f352907cf47750747e1ed93
push idunknown
push userunknown
push dateunknown
Fix register allocation around inline returns, bug 713209.
--- a/js/src/methodjit/FrameState-inl.h
+++ b/js/src/methodjit/FrameState-inl.h
@@ -1120,18 +1120,19 @@ FrameState::frameSlot(ActiveFrame *a, co
         return analyze::ThisSlot();
     if (fe == a->callee_)
         return analyze::CalleeSlot();
     JS_NOT_REACHED("Bad fe");
     return 0;
 inline JSC::MacroAssembler::Address
-FrameState::addressForInlineReturn() const
+    discardFe(a->callee_);
     return addressOf(a->callee_);
 inline JSC::MacroAssembler::Address
 FrameState::addressForDataRemat(const FrameEntry *fe) const
     if (fe->isCopy() && !fe->data.synced())
         fe = fe->copyOf();
--- a/js/src/methodjit/FrameState.h
+++ b/js/src/methodjit/FrameState.h
@@ -872,17 +872,17 @@ class FrameState
     // Returns an address, relative to the StackFrame, that represents where
     // this FrameEntry is backed in memory. This is not necessarily its
     // canonical address, but the address for which the payload has been synced
     // to memory. The caller guarantees that the payload has been synced.
     Address addressForDataRemat(const FrameEntry *fe) const;
     // Inside an inline frame, the address for the return value in the caller.
-    Address addressForInlineReturn() const;
+    Address addressForInlineReturn();
     inline StateRemat dataRematInfo(const FrameEntry *fe) const;
      * This is similar to freeReg(ownRegForData(fe)) - except no movement takes place.
      * The fe is simply invalidated as if it were popped. This can be used to free
      * registers in the working area of the stack. Obviously, this can only be called
      * in infallible code that will pop these entries soon after.