Changeset 204699 in webkit
- Timestamp:
- Aug 21, 2016 8:47:49 PM (8 years ago)
- Location:
- trunk
- Files:
-
- 1 added
- 3 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/JSTests/ChangeLog
r204698 r204699 1 2016-08-21 Yusuke Suzuki <utatane.tea@gmail.com> 2 3 [DFG] Should not fixup AnyIntUse in 32_64 4 https://bugs.webkit.org/show_bug.cgi?id=161029 5 6 Reviewed by Saam Barati. 7 8 * typeProfiler/int52-dfg.js: Added. 9 (test): 10 1 11 2016-08-21 Yusuke Suzuki <utatane.tea@gmail.com> 2 12 -
trunk/Source/JavaScriptCore/ChangeLog
r204698 r204699 1 2016-08-21 Yusuke Suzuki <utatane.tea@gmail.com> 2 3 [DFG] Should not fixup AnyIntUse in 32_64 4 https://bugs.webkit.org/show_bug.cgi?id=161029 5 6 Reviewed by Saam Barati. 7 8 DFG fixup phase uses AnyIntUse even in 32bit DFG. This patch removes this incorrect filtering. 9 If the 32bit DFG see the TypeAnyInt, it should fallback to the NumberUse case. 10 11 * dfg/DFGFixupPhase.cpp: 12 (JSC::DFG::FixupPhase::fixupNode): 13 1 14 2016-08-21 Yusuke Suzuki <utatane.tea@gmail.com> 2 15 -
trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
r204698 r204699 1460 1460 RuntimeTypeMask seenTypes = typeSet->seenTypes(); 1461 1461 if (typeSet->doesTypeConformTo(TypeAnyInt)) { 1462 if (node->child1()->shouldSpeculateInt32()) 1462 if (node->child1()->shouldSpeculateInt32()) { 1463 1463 fixEdge<Int32Use>(node->child1()); 1464 else 1464 node->remove(); 1465 break; 1466 } 1467 1468 if (enableInt52()) { 1465 1469 fixEdge<AnyIntUse>(node->child1()); 1466 node->remove(); 1467 } else if (typeSet->doesTypeConformTo(TypeNumber | TypeAnyInt)) { 1470 node->remove(); 1471 break; 1472 } 1473 1474 // Must not perform fixEdge<NumberUse> here since the type set only includes TypeAnyInt. Double values should be logged. 1475 } 1476 1477 if (typeSet->doesTypeConformTo(TypeNumber | TypeAnyInt)) { 1468 1478 fixEdge<NumberUse>(node->child1()); 1469 1479 node->remove();
Note: See TracChangeset
for help on using the changeset viewer.