Changeset 95233 in webkit

Timestamp:

Sep 15, 2011 2:53:48 PM (13 years ago)

Author:

fpizlo@apple.com

Message:

DFG speculative JIT sometimes asserts that a value is not a number
even when it doesn't know anything about the number
​https://bugs.webkit.org/show_bug.cgi?id=68189

Reviewed by Oliver Hunt.

• dfg/DFGGenerationInfo.h:

(JSC::DFG::GenerationInfo::isUnknownJS):

• dfg/DFGJITCodeGenerator.cpp:

(JSC::DFG::JITCodeGenerator::isKnownNotNumber):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGGenerationInfo.h (modified) (1 diff)
• dfg/DFGJITCodeGenerator.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-09-15  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG speculative JIT sometimes asserts that a value is not a number
+        even when it doesn't know anything about the number
+        https://bugs.webkit.org/show_bug.cgi?id=68189
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::isUnknownJS):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::isKnownNotNumber):
+
 2011-09-15  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGGenerationInfo.h

@@ -260 +260 @@
         return isJSFormat(DataFormatJSBoolean);
     }
+    
+    bool isUnknownJS()
+    {
+        return registerFormat() == DataFormatNone || registerFormat() == DataFormatJS
+            || spillFormat() == DataFormatNone || spillFormat() == DataFormatJS;
+    }
 
     // Get the machine resister currently holding the value.

trunk/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.cpp

@@ -415 +415 @@
     GenerationInfo& info = m_generationInfo[virtualRegister];
     
-    return (!info.isJSDouble() && !info.isJSInteger())
+    return (!info.isJSDouble() && !info.isJSInteger() && !info.isUnknownJS())
         || (node.isConstant() && !isNumberConstant(nodeIndex));
 }