Changeset 140203 in webkit

Timestamp:

Jan 18, 2013 1:45:06 PM (11 years ago)

Author:

msaboff@apple.com

Message:

Harden ArithDiv of integers fix-up by inserting Int32ToDouble node directly
​https://bugs.webkit.org/show_bug.cgi?id=107321

Reviewed by Filip Pizlo.

Split out the Int32ToDouble node insertion from fixDoubleEdge() and used it directly when we're fixing up
an ArithDiv node with integer inputs and output for platforms that don't have integer division.
Since we are checking that our inputs should be ints, we can just insert the Int32ToDouble node
without any further checks.

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixDoubleEdge):
(FixupPhase):
(JSC::DFG::FixupPhase::injectInt32ToDoubleNode):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGFixupPhase.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2013-01-18  Michael Saboff  <msaboff@apple.com>
+
+        Harden ArithDiv of integers fix-up by inserting Int32ToDouble node directly
+        https://bugs.webkit.org/show_bug.cgi?id=107321
+
+        Reviewed by  Filip Pizlo.
+
+        Split out the Int32ToDouble node insertion from fixDoubleEdge() and used it directly when we're fixing up
+        an ArithDiv node with integer inputs and output for platforms that don't have integer division.
+        Since we are checking that our inputs should be ints, we can just insert the Int32ToDouble node
+        without any further checks.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixDoubleEdge):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
+
 2013-01-18  Michael Saboff  <msaboff@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

@@ -321 +321 @@
                 if (isX86())
                     break;
-                fixDoubleEdge(0);
-                fixDoubleEdge(1);
+                injectInt32ToDoubleNode(0);
+                injectInt32ToDoubleNode(1);
                 
                 Node& oldDivision = m_graph[m_compileIndex];
@@ -559 +559 @@
         }
         
+        injectInt32ToDoubleNode(childIndex);
+    }
+
+    void injectInt32ToDoubleNode(unsigned childIndex)
+    {
+        Node& source = m_graph[m_compileIndex];
+        Edge& edge = m_graph.child(source, childIndex);
+        
         NodeIndex resultIndex = (NodeIndex)m_graph.size();