Changeset 199148 in webkit


Ignore:
Timestamp:
Apr 6, 2016 9:33:32 PM (8 years ago)
Author:
commit-queue@webkit.org
Message:

[JSC] UInt32ToNumber should be NodeMustGenerate
​https://bugs.webkit.org/show_bug.cgi?id=156329

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2016-04-06
Reviewed by Filip Pizlo.

It exits on negative numbers on the integer path.

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

  • dfg/DFGNodeType.h:
Location:
trunk/Source/JavaScriptCore
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r199145 r199148  
     12016-04-06  Benjamin Poulain  <bpoulain@apple.com>
     2
     3        [JSC] UInt32ToNumber should be NodeMustGenerate
     4        https://bugs.webkit.org/show_bug.cgi?id=156329
     5
     6        Reviewed by Filip Pizlo.
     7
     8        It exits on negative numbers on the integer path.
     9
     10        * dfg/DFGFixupPhase.cpp:
     11        (JSC::DFG::FixupPhase::fixupNode):
     12        * dfg/DFGNodeType.h:
     13
    1142016-04-04  Geoffrey Garen  <ggaren@apple.com>
    215

  • trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

    r199128 r199148  
    142142                node->setArithMode(Arith::DoOverflow);
    143143                node->setResult(NodeResultDouble);
     144                node->clearFlags(NodeMustGenerate);
    144145            }
    145146            break;

  • trunk/Source/JavaScriptCore/dfg/DFGNodeType.h

    r199128 r199148  
    120120    macro(ValueToInt32, NodeResultInt32) \
    121121    /* Used to box the result of URShift nodes (result has range 0..2^32-1). */\
    122     macro(UInt32ToNumber, NodeResultNumber) \
     122    macro(UInt32ToNumber, NodeResultNumber | NodeMustGenerate) \
    123123    /* Converts booleans to numbers but passes everything else through. */\
    124124    macro(BooleanToNumber, NodeResultJS) \
Note: See TracChangeset for help on using the changeset viewer.