Results (81 - 90 of 827)
- Quickjump to bpoulain@apple.com
- [200743]: [JSC] Make sure StringRange is passed to Vector by register ...
- ... org/show_bug.cgi?id=157603 Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-05-11 Reviewed by Darin Adler. This is bizarre, but on my SDK, Vector::append(StringRange) is passing the values on the stack. The two integers are written to the stack, the address given to append(), then appen ...
- By May 11, 2016 11:34:41 PM —
- [200645]: [JSC] FTL can produce GetByVal nodes without proper bounds checking ...
- ... //problem/26027027 Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-05-10 Reviewed by Filip Pizlo. It was possible for FTL to generates GetByVal on arbitrary offsets without any bounds checking. The bug is caused by the order of optimization phases: -First, the Integer Range Op ...
- By May 10, 2016 2:35:32 PM —
- [200541]: [JSC][32bit] stress/tagged-templates-template-object.js fails in debug ...
- ... org/show_bug.cgi?id=157436 Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-05-07 Reviewed by Filip Pizlo. * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): The node OverridesHasInstance had a speculation after a jump.
- By May 7, 2016 1:19:49 AM —
- [200502]: [JSC] Get rid of NonNegZeroDouble, it is broken ...
- ... //problem/25339647 Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-05-05 Reviewed by Mark Lam. The profile "NonNegZeroDouble" is fundamentally broken. It is used by DFG to predict the result of ArithMul as being a Double or Int32. The problem is you are likely to mispredict, a ...
- By May 5, 2016 7:30:51 PM —
- [200498]: [JSC] In DFG, an OSR Exit on SetLocal can trash its child node ...
- ... //problem/25339647 Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-05-05 Reviewed by Filip Pizlo. When we OSR Exit on SetLocal, the child is never restored if its representation was changed since the MovHint. For example, say we have: @1 = SomethingProducingDouble() @2 ...
- By May 5, 2016 5:05:04 PM —
- [200277]: [JSC][ARMv7S] Arithmetic module results change when tiering up to DFG ...
- ... //problem/24733432 Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-04-29 Reviewed by Mark Lam. ARMv7's fmod() returns less accurate results than an integer division. Since we have integer div on ARMv7s, the results start changing when we reach DFG. In this patch, I change our ...
- By Apr 29, 2016 6:50:42 PM —
- [200208]: [JSC] Unify Math.pow() accross all tiers ...
- ... org/show_bug.cgi?id=157121 Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-04-28 Reviewed by Geoffrey Garen. My previous optimizations of DFG compile time have slowly regressed Sunspider's math-partial-sums. What is happenning is baseline used a thunk for Math.pow() that has a special ...
- By Apr 28, 2016 1:50:08 PM —
- [200133]: Follow up for r200113 on 32bit I forgot to do the 32bit counterpart ...
- ... The test fails on the bots. Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-04-27 * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile):
- By Apr 27, 2016 10:58:14 AM —
- [200113]: [JSC] GetByVal on Undecided use its children before its OSR Exit ...
- ... org/show_bug.cgi?id=157046 Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-04-26 Reviewed by Mark Lam. Very silly bug: GetByVal on Undecided uses its children before the speculationCheck(). If we fail the speculation, we have already lost how to recover the values. The existing tests ...
- By Apr 26, 2016 4:26:19 PM —
- [200071]: [JSC] Constant folding of UInt32ToNumber is incorrect ...
- ... //problem/25769641 Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-04-25 Reviewed by Geoffrey Garen. UInt32ToNumber should return the unsigned 32bit value of its child. The abstract interpreter fails to do that when handling Int52. None of the tests caught that because the byt ...
- By Apr 25, 2016 9:08:22 PM —
Note: See TracSearch
for help on searching.