Changeset 260377 in webkit


Ignore:
Timestamp:
Apr 20, 2020 11:06:26 AM (4 years ago)
Author:
keith_miller@apple.com
Message:

Fix CheckIsConstant for non-constant values and checking for empty
https://bugs.webkit.org/show_bug.cgi?id=210752

Reviewed by Saam Barati.

We need to make sure that we only have one speculated type if our value
is empty.

  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

Location:
trunk/Source/JavaScriptCore
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/Source/JavaScriptCore/ChangeLog

    r260366 r260377  
     12020-04-20  Keith Miller  <keith_miller@apple.com>
     2
     3        Fix CheckIsConstant for non-constant values and checking for empty
     4        https://bugs.webkit.org/show_bug.cgi?id=210752
     5
     6        Reviewed by Saam Barati.
     7
     8        We need to make sure that we only have one speculated type if our value
     9        is empty.
     10
     11        * dfg/DFGAbstractInterpreterInlines.h:
     12        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
     13
    1142020-04-20  Darin Adler  <darin@apple.com>
    215
  • trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

    r260331 r260377  
    38173817   
    38183818    case CheckIsConstant: {
    3819         JSValue value = forNode(node->child1()).value();
    3820         if (value == node->constant()->value()) {
     3819        AbstractValue& value = forNode(node->child1());
     3820        if (value.value() == node->constant()->value() && (value.value() || value.m_type == SpecEmpty)) {
    38213821            m_state.setShouldTryConstantFolding(true);
    3822             ASSERT(value || forNode(node->child1()).m_type == SpecEmpty);
    38233822            break;
    38243823        }
Note: See TracChangeset for help on using the changeset viewer.