Changeset 244763 in webkit

Timestamp:

Apr 29, 2019 7:54:08 PM (5 years ago)

Author:

ysuzuki@apple.com

Message:

Unreivewed, fix FTL implementation of r244760
​https://bugs.webkit.org/show_bug.cgi?id=197362

Reviewed by Saam Barati.

Looked with Saam. ValueFromBlock from double case block was overridden by NaN thing now.

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNormalizeMapKey):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• ftl/FTLLowerDFGToB3.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-04-29  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        Unreivewed, fix FTL implementation of r244760
+        https://bugs.webkit.org/show_bug.cgi?id=197362
+
+        Reviewed by Saam Barati.
+
+        Looked with Saam. ValueFromBlock from double case block was overridden by NaN thing now.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNormalizeMapKey):
+
 2019-04-29  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -9829 +9829 @@
         LValue integerValue = m_out.doubleToInt(doubleValue);
         LValue integerValueConvertedToDouble = m_out.intToDouble(integerValue);
+        ValueFromBlock doubleResult = m_out.anchor(key);
         m_out.branch(m_out.doubleNotEqualOrUnordered(doubleValue, integerValueConvertedToDouble), unsure(continuation), unsure(convertibleCase));
 
@@ -9836 +9837 @@
 
         m_out.appendTo(continuation, lastNext);
-        setJSValue(m_out.phi(Int64, fastResult, normalizedNaNResult, boxedIntResult));
+        setJSValue(m_out.phi(Int64, fastResult, normalizedNaNResult, doubleResult, boxedIntResult));
     }