Changeset 96306 in webkit

Timestamp:

Sep 29, 2011 12:12:10 AM (13 years ago)

Author:

fpizlo@apple.com

Message:

DFG checkArgumentTypes fails to check boolean predictions
​https://bugs.webkit.org/show_bug.cgi?id=69059

Reviewed by Gavin Barraclough.

Source/JavaScriptCore:

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::checkArgumentTypes):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::checkArgumentTypes):

LayoutTests:

• fast/js/boolean-argument-prediction-expected.txt: Added.
• fast/js/boolean-argument-prediction.html: Added.
• fast/js/script-tests/boolean-argument-prediction.js: Added.

(predictBooleanArgument):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/boolean-argument-prediction-expected.txt (added)
• LayoutTests/fast/js/boolean-argument-prediction.html (added)
• LayoutTests/fast/js/script-tests/boolean-argument-prediction.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-09-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG checkArgumentTypes fails to check boolean predictions
+        https://bugs.webkit.org/show_bug.cgi?id=69059
+
+        Reviewed by Gavin Barraclough.
+
+        * fast/js/boolean-argument-prediction-expected.txt: Added.
+        * fast/js/boolean-argument-prediction.html: Added.
+        * fast/js/script-tests/boolean-argument-prediction.js: Added.
+        (predictBooleanArgument):
+
 2011-09-28  Shinichiro Hamaji  <hamaji@chromium.org>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-09-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG checkArgumentTypes fails to check boolean predictions
+        https://bugs.webkit.org/show_bug.cgi?id=69059
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+
 2011-09-28  Gavin Barraclough  <barraclough@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -2286 +2286 @@
             speculationCheck(m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
             speculationCheck(m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->jsArrayVPtr)));
+        } else if (isBooleanPrediction(predictedType)) {
+            GPRTemporary temp(this);
+            m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
+            m_jit.xorPtr(TrustedImm32(static_cast<int32_t>(ValueFalse)), temp.gpr());
+            speculationCheck(m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), TrustedImm32(static_cast<int32_t>(~1))));
         }
     }

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

@@ -2222 +2222 @@
             m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
             speculationCheck(m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->jsArrayVPtr)));
-        }
+        } // FIXME: need boolean predictions, but we currently don't have that support.
     }
 }