Changeset 176972 in webkit

Timestamp:

Dec 8, 2014 2:12:25 PM (9 years ago)

Author:

mark.lam@apple.com

Message:

CFA wrongly assumes that a speculation for SlowPutArrayStorageShape disallows ArrayStorageShape arrays.
<​https://webkit.org/b/139327>

Reviewed by Michael Saboff.

Source/JavaScriptCore:

The code generator and runtime slow paths expects otherwise. This patch fixes
CFA to match the code generator's expectation.

• dfg/DFGArrayMode.h:

(JSC::DFG::ArrayMode::arrayModesThatPassFiltering):
(JSC::DFG::ArrayMode::arrayModesWithIndexingShapes):

LayoutTests:

• js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage-expected.txt: Added.
• js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.html: Added.
• js/script-tests/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.js: Added.

(foo):
(test):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage-expected.txt (added)
• LayoutTests/js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.html (added)
• LayoutTests/js/script-tests/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGArrayMode.h (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2014-12-08  Mark Lam  <mark.lam@apple.com>
+
+        CFA wrongly assumes that a speculation for SlowPutArrayStorageShape disallows ArrayStorageShape arrays.
+        <https://webkit.org/b/139327>
+
+        Reviewed by Michael Saboff.
+
+        * js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage-expected.txt: Added.
+        * js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.html: Added.
+        * js/script-tests/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.js: Added.
+        (foo):
+        (test):
+
 2014-12-08  Myles C. Maxfield  <mmaxfield@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-12-08  Mark Lam  <mark.lam@apple.com>
+
+        CFA wrongly assumes that a speculation for SlowPutArrayStorageShape disallows ArrayStorageShape arrays.
+        <https://webkit.org/b/139327>
+
+        Reviewed by Michael Saboff.
+
+        The code generator and runtime slow paths expects otherwise.  This patch fixes
+        CFA to match the code generator's expectation.
+
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::arrayModesThatPassFiltering):
+        (JSC::DFG::ArrayMode::arrayModesWithIndexingShapes):
+
 2014-12-08  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGArrayMode.h

@@ -407 +407 @@
             return arrayModesWithIndexingShape(ArrayStorageShape);
         case Array::SlowPutArrayStorage:
-            return arrayModesWithIndexingShape(SlowPutArrayStorageShape);
+            return arrayModesWithIndexingShapes(SlowPutArrayStorageShape, ArrayStorageShape);
         default:
             return asArrayModes(NonArray);
@@ -463 +463 @@
     }
     
+    ArrayModes arrayModesWithIndexingShapes(IndexingType shape1, IndexingType shape2) const
+    {
+        ArrayModes arrayMode1 = arrayModesWithIndexingShape(shape1);
+        ArrayModes arrayMode2 = arrayModesWithIndexingShape(shape2);
+        return arrayMode1 | arrayMode2;
+    }
+
     bool alreadyChecked(Graph&, Node*, AbstractValue&, IndexingType shape) const;