Changeset 152742 in webkit

Timestamp:

Jul 16, 2013, 2:41:06 PM (12 years ago)

Author:

fpizlo@apple.com

Message:

MakeRope fixup shouldn't lead to an Identity without kids
​https://bugs.webkit.org/show_bug.cgi?id=118745

Source/JavaScriptCore:

Reviewed by Mark Hahnenberg.

Make the empty string pruning part of fixupMakeRope() stop if it's on the last child.

Make Node::convertToIdentity release-assert that it has exactly one kid.

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupMakeRope):

• dfg/DFGNode.h:

(JSC::DFG::Node::convertToIdentity):

LayoutTests:

Reviewed by Mark Hahnenberg.

• fast/js/dfg-make-rope-all-empty-strings.html: Added.
• fast/js/dfg-make-rope-all-empty-strings-expected.txt: Added.
• fast/js/jsc-test-list:
• fast/js/script-tests/dfg-make-rope-all-empty-strings.js: Added.

(foo):
(bar):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/dfg-make-rope-all-empty-strings-expected.txt (added)
• LayoutTests/fast/js/dfg-make-rope-all-empty-strings.html (added)
• LayoutTests/fast/js/jsc-test-list (modified) (1 diff)
• LayoutTests/fast/js/script-tests/dfg-make-rope-all-empty-strings.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGNode.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-07-16  Filip Pizlo  <fpizlo@apple.com>
+
+        MakeRope fixup shouldn't lead to an Identity without kids
+        https://bugs.webkit.org/show_bug.cgi?id=118745
+
+        Reviewed by Mark Hahnenberg.
+
+        * fast/js/dfg-make-rope-all-empty-strings.html: Added.
+        * fast/js/dfg-make-rope-all-empty-strings-expected.txt: Added.
+        * fast/js/jsc-test-list:
+        * fast/js/script-tests/dfg-make-rope-all-empty-strings.js: Added.
+        (foo):
+        (bar):
+
 2013-07-16  Roger Fong  <roger_fong@apple.com>
 

trunk/LayoutTests/fast/js/jsc-test-list

@@ -182 +182 @@
 fast/js/dfg-intrinsic-unused-this
 fast/js/dfg-intrinsic-unused-this-method-check
+fast/js/dfg-make-rope-all-empty-strings
 fast/js/dfg-max-backwards-propagation
 fast/js/dfg-min-backwards-propagation

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2013-07-16  Filip Pizlo  <fpizlo@apple.com>
+
+        MakeRope fixup shouldn't lead to an Identity without kids
+        https://bugs.webkit.org/show_bug.cgi?id=118745
+
+        Reviewed by Mark Hahnenberg.
+        
+        Make the empty string pruning part of fixupMakeRope() stop if it's on the last child.
+        
+        Make Node::convertToIdentity release-assert that it has exactly one kid.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupMakeRope):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToIdentity):
+
 2013-07-16  Mark Hahnenberg  <mhahnenberg@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

@@ -961 +961 @@
             if (string->length())
                 continue;
+            
+            // Don't allow the MakeRope to have zero children.
+            if (!i && !node->child2())
+                break;
+            
             node->children.removeEdge(i--);
         }

trunk/Source/JavaScriptCore/dfg/DFGNode.h

@@ -222 +222 @@
     void convertToIdentity()
     {
+        RELEASE_ASSERT(child1());
+        RELEASE_ASSERT(!child2());
         setOpAndDefaultNonExitFlags(Identity);
     }