Changeset 260549 in webkit

Timestamp:

Apr 22, 2020 7:14:22 PM (4 years ago)

Author:

sbarati@apple.com

Message:

Edge use kind asserts are wrong for BigInt32 on ValueBitLShift
​https://bugs.webkit.org/show_bug.cgi?id=210872

Reviewed by Yusuke Suzuki, Mark Lam, and Robin Morisset.

This is already covered by the v8 tests Yusuke checked in.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::emitUntypedOrAnyBigIntBitOp):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileValueBitLShift):
(JSC::FTL::DFG::LowerDFGToB3::emitBinaryBitOpSnippet):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)
• ftl/FTLLowerDFGToB3.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-04-22  Saam Barati  <sbarati@apple.com>
+
+        Edge use kind asserts are wrong for BigInt32 on ValueBitLShift
+        https://bugs.webkit.org/show_bug.cgi?id=210872
+
+        Reviewed by Yusuke Suzuki, Mark Lam, and Robin Morisset.
+
+        This is already covered by the v8 tests Yusuke checked in.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitUntypedOrAnyBigIntBitOp):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileValueBitLShift):
+        (JSC::FTL::DFG::LowerDFGToB3::emitBinaryBitOpSnippet):
+
 2020-04-22  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -3620 +3620 @@
     Edge& rightChild = node->child2();
 
-    ASSERT(leftChild.useKind() == UntypedUse || leftChild.useKind() == AnyBigIntUse || rightChild.useKind() == UntypedUse || rightChild.useKind() == AnyBigIntUse);
+    DFG_ASSERT(m_jit.graph(), node, node->isBinaryUseKind(UntypedUse) || node->isBinaryUseKind(AnyBigIntUse) || node->isBinaryUseKind(HeapBigIntUse) || node->isBinaryUseKind(BigInt32Use));
 
     if (isKnownNotNumber(leftChild.node()) || isKnownNotNumber(rightChild.node())) {

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -3471 +3471 @@
         }
 
-        ASSERT(m_node->isBinaryUseKind(UntypedUse));
+        DFG_ASSERT(m_graph, m_node, m_node->isBinaryUseKind(UntypedUse) || m_node->isBinaryUseKind(AnyBigIntUse) || m_node->isBinaryUseKind(BigInt32Use));
         emitBinaryBitOpSnippet<JITLeftShiftGenerator>(operationValueBitLShift);
     }
@@ -14753 +14753 @@
         Node* node = m_node;
         
-        ASSERT(node->isBinaryUseKind(UntypedUse) || node->isBinaryUseKind(AnyBigIntUse));
+        DFG_ASSERT(m_graph, node, node->isBinaryUseKind(UntypedUse) || node->isBinaryUseKind(AnyBigIntUse) || node->isBinaryUseKind(BigInt32Use));
         LValue left = lowJSValue(node->child1(), ManualOperandSpeculation);
         LValue right = lowJSValue(node->child2(), ManualOperandSpeculation);