Changeset 204698 in webkit

Timestamp:

Aug 21, 2016 1:36:49 PM (8 years ago)

Author:

Yusuke Suzuki

Message:

Unreviewed, rolling out r204697
​https://bugs.webkit.org/show_bug.cgi?id=161029

JSTests:

• typeProfiler/int52-dfg.js: Removed.

(test): Deleted.

• typeProfiler/number-filter-dfg.js: Removed.

(test): Deleted.

Source/JavaScriptCore:

32bit is OK. DFGSpeculativeJIT64.cpp shortcut also need some cares.

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/typeProfiler/int52-dfg.js (deleted)
• JSTests/typeProfiler/number-filter-dfg.js (deleted)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2016-08-21  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, rolling out r204697
+        https://bugs.webkit.org/show_bug.cgi?id=161029
+
+        * typeProfiler/int52-dfg.js: Removed.
+        (test): Deleted.
+        * typeProfiler/number-filter-dfg.js: Removed.
+        (test): Deleted.
+
 2016-08-21  Yusuke Suzuki  <utatane.tea@gmail.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-08-21  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, rolling out r204697
+        https://bugs.webkit.org/show_bug.cgi?id=161029
+
+        32bit is OK. DFGSpeculativeJIT64.cpp shortcut also need some cares.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
 2016-08-21  Yusuke Suzuki  <utatane.tea@gmail.com>
 

trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

@@ -1460 +1460 @@
             RuntimeTypeMask seenTypes = typeSet->seenTypes();
             if (typeSet->doesTypeConformTo(TypeAnyInt)) {
-                if (node->child1()->shouldSpeculateInt32()) {
+                if (node->child1()->shouldSpeculateInt32())
                     fixEdge<Int32Use>(node->child1());
-                    node->remove();
-                    break;
-                }
-
-                if (enableInt52()) {
+                else
                     fixEdge<AnyIntUse>(node->child1());
-                    node->remove();
-                    break;
-                }
-
-                // Must not perform fixEdge<NumberUse> here since the type set only includes TypeAnyInt. Double values should be logged.
-            }
-
-            if (typeSet->doesTypeConformTo(TypeNumber | TypeAnyInt) && ((seenTypes & TypeNumber) && (seenTypes & TypeAnyInt))) {
-                // NumberUse can pass TypeNumber and TypeAnyInt. Thus, this node removal is allowed only if both TypeNumber and TypeAnyInt are logged in the type set.
+                node->remove();
+            } else if (typeSet->doesTypeConformTo(TypeNumber | TypeAnyInt)) {
                 fixEdge<NumberUse>(node->child1());
                 node->remove();