Changeset 204697 in webkit

Timestamp:

Aug 21, 2016 12:45:50 PM (8 years ago)

Author:

Yusuke Suzuki

Message:

[DFG] Should not fixup AnyIntUse in 32_64
​https://bugs.webkit.org/show_bug.cgi?id=161029

Reviewed by Saam Barati.

JSTests:

• typeProfiler/int52-dfg.js: Added.

(test):

• typeProfiler/number-filter-dfg.js: Added.

(test):

Source/JavaScriptCore:

DFG fixup phase uses AnyIntUse even in 32bit DFG. This patch removes this incorrect filtering.
If the 32bit DFG see the TypeAnyInt, it should fallback to the NumberUse case.

And this patch also fixes the case that the type set only contains TypeNumber. Previously,
we used NumberUse edge filtering. But it misses AnyInt logging: While the NumberUse filter
passes both TypeAnyInt and TypeNumber, the type set only logged TypeNumber.

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/typeProfiler/int52-dfg.js (added)
• JSTests/typeProfiler/number-filter-dfg.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2016-08-21  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DFG] Should not fixup AnyIntUse in 32_64
+        https://bugs.webkit.org/show_bug.cgi?id=161029
+
+        Reviewed by Saam Barati.
+
+        * typeProfiler/int52-dfg.js: Added.
+        (test):
+        * typeProfiler/number-filter-dfg.js: Added.
+        (test):
+
 2016-08-19  Benjamin Poulain  <bpoulain@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-08-21  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DFG] Should not fixup AnyIntUse in 32_64
+        https://bugs.webkit.org/show_bug.cgi?id=161029
+
+        Reviewed by Saam Barati.
+
+        DFG fixup phase uses AnyIntUse even in 32bit DFG. This patch removes this incorrect filtering.
+        If the 32bit DFG see the TypeAnyInt, it should fallback to the NumberUse case.
+
+        And this patch also fixes the case that the type set only contains TypeNumber. Previously,
+        we used NumberUse edge filtering. But it misses AnyInt logging: While the NumberUse filter
+        passes both TypeAnyInt and TypeNumber, the type set only logged TypeNumber.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
 2016-08-20  Brian Burg  <bburg@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

@@ -1460 +1460 @@
             RuntimeTypeMask seenTypes = typeSet->seenTypes();
             if (typeSet->doesTypeConformTo(TypeAnyInt)) {
-                if (node->child1()->shouldSpeculateInt32())
+                if (node->child1()->shouldSpeculateInt32()) {
                     fixEdge<Int32Use>(node->child1());
-                else
+                    node->remove();
+                    break;
+                }
+
+                if (enableInt52()) {
                     fixEdge<AnyIntUse>(node->child1());
-                node->remove();
-            } else if (typeSet->doesTypeConformTo(TypeNumber | TypeAnyInt)) {
+                    node->remove();
+                    break;
+                }
+
+                // Must not perform fixEdge<NumberUse> here since the type set only includes TypeAnyInt. Double values should be logged.
+            }
+
+            if (typeSet->doesTypeConformTo(TypeNumber | TypeAnyInt) && ((seenTypes & TypeNumber) && (seenTypes & TypeAnyInt))) {
+                // NumberUse can pass TypeNumber and TypeAnyInt. Thus, this node removal is allowed only if both TypeNumber and TypeAnyInt are logged in the type set.
                 fixEdge<NumberUse>(node->child1());
                 node->remove();