Changeset 243206 in webkit

Timestamp:

Mar 20, 2019, 9:17:44 AM (7 years ago)

Author:

sbarati@apple.com

Message:

AI rule for ValueBitNot/ValueBitXor/ValueBitAnd/ValueBitOr is wrong
​https://bugs.webkit.org/show_bug.cgi?id=195980

Reviewed by Yusuke Suzuki.

They were all saying they could be type: (SpecBoolInt32, SpecBigInt)
However, they should have been type: (SpecInt32Only, SpecBigInt)

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGAbstractInterpreterInlines.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-03-20  Saam Barati  <sbarati@apple.com>
+
+        AI rule for ValueBitNot/ValueBitXor/ValueBitAnd/ValueBitOr is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=195980
+
+        Reviewed by Yusuke Suzuki.
+
+        They were all saying they could be type: (SpecBoolInt32, SpecBigInt)
+        However, they should have been type: (SpecInt32Only, SpecBigInt)
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
 2019-03-20  Michael Catanzaro  <mcatanzaro@igalia.com>
 

trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

@@ -390 +390 @@
         else {
             clobberWorld();
-            setTypeForNode(node, SpecBoolInt32 | SpecBigInt);
+            setTypeForNode(node, SpecInt32Only | SpecBigInt);
         }
 
@@ -415 +415 @@
         else {
             clobberWorld();
-            setTypeForNode(node, SpecBoolInt32 | SpecBigInt);
+            setTypeForNode(node, SpecInt32Only | SpecBigInt);
         }
         break;