WebKit Bugzilla
New
Browse
Search+
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
[patch]
ROLLOUT of r165085
bug-129729-20140304231647.patch (text/plain), 33.06 KB, created by
WebKit Commit Bot
on 2014-03-04 23:16:48 PST
(
hide
)
Description:
ROLLOUT of r165085
Filename:
MIME Type:
Creator:
WebKit Commit Bot
Created:
2014-03-04 23:16:48 PST
Size:
33.06 KB
patch
obsolete
>Subversion Revision: 165097 >diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog >index 12ee6dd22ea890ebb1046c7f85ac9737c1f208c1..db27faf9207c8afdc54807a817002dc9ecfb84ce 100644 >--- a/Source/JavaScriptCore/ChangeLog >+++ b/Source/JavaScriptCore/ChangeLog >@@ -1,3 +1,47 @@ >+2014-03-04 Commit Queue <commit-queue@webkit.org> >+ >+ Unreviewed, rolling out r165085. >+ http://trac.webkit.org/changeset/165085 >+ https://bugs.webkit.org/show_bug.cgi?id=129729 >+ >+ Broke imported/w3c/html-templates/template-element/template- >+ content.html (Requested by ap on #webkit). >+ >+ * bytecode/SpeculatedType.cpp: >+ (JSC::speculationToAbbreviatedString): >+ * bytecode/SpeculatedType.h: >+ * dfg/DFGAbstractInterpreterInlines.h: >+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): >+ * dfg/DFGArrayMode.cpp: >+ (JSC::DFG::ArrayMode::refine): >+ * dfg/DFGArrayMode.h: >+ * dfg/DFGFixupPhase.cpp: >+ (JSC::DFG::FixupPhase::fixupNode): >+ (JSC::DFG::FixupPhase::attemptToMakeGetArrayLength): >+ * dfg/DFGNode.h: >+ (JSC::DFG::Node::shouldSpeculateBoolean): >+ * dfg/DFGSafeToExecute.h: >+ (JSC::DFG::SafeToExecuteEdge::operator()): >+ * dfg/DFGSpeculativeJIT.cpp: >+ (JSC::DFG::SpeculativeJIT::compileStrictEq): >+ (JSC::DFG::SpeculativeJIT::speculate): >+ * dfg/DFGSpeculativeJIT.h: >+ * dfg/DFGSpeculativeJIT32_64.cpp: >+ * dfg/DFGSpeculativeJIT64.cpp: >+ * dfg/DFGUseKind.cpp: >+ (WTF::printInternal): >+ * dfg/DFGUseKind.h: >+ (JSC::DFG::typeFilterFor): >+ * ftl/FTLCapabilities.cpp: >+ (JSC::FTL::canCompile): >+ * ftl/FTLLowerDFGToLLVM.cpp: >+ (JSC::FTL::LowerDFGToLLVM::compileNode): >+ (JSC::FTL::LowerDFGToLLVM::compileCompareEq): >+ (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq): >+ (JSC::FTL::LowerDFGToLLVM::speculate): >+ * tests/stress/float32-array-out-of-bounds.js: Removed. >+ * tests/stress/weird-equality-folding-cases.js: Removed. >+ > 2014-03-04 Brian Burg <bburg@apple.com> > > Inspector does not restore breakpoints after a page reload >diff --git a/Source/JavaScriptCore/bytecode/SpeculatedType.cpp b/Source/JavaScriptCore/bytecode/SpeculatedType.cpp >index 041eb1cd0d1050cd38ce702873fb55d97d128e50..aca45b7b677706f8ef1d76b37b169c78941c91e5 100644 >--- a/Source/JavaScriptCore/bytecode/SpeculatedType.cpp >+++ b/Source/JavaScriptCore/bytecode/SpeculatedType.cpp >@@ -255,8 +255,6 @@ static const char* speculationToAbbreviatedString(SpeculatedType prediction) > return "<Boolean>"; > if (isOtherSpeculation(prediction)) > return "<Other>"; >- if (isMiscSpeculation(prediction)) >- return "<Misc>"; > return ""; > } > >@@ -393,40 +391,5 @@ TypedArrayType typedArrayTypeFromSpeculation(SpeculatedType type) > return NotTypedArray; > } > >-SpeculatedType leastUpperBoundOfStrictlyEquivalentSpeculations(SpeculatedType type) >-{ >- if (type & SpecInteger) >- type |= SpecInteger; >- if (type & SpecString) >- type |= SpecString; >- return type; >-} >- >-bool valuesCouldBeEqual(SpeculatedType a, SpeculatedType b) >-{ >- a = leastUpperBoundOfStrictlyEquivalentSpeculations(a); >- b = leastUpperBoundOfStrictlyEquivalentSpeculations(b); >- >- // Anything could be equal to a string. >- if (a & SpecString) >- return true; >- if (b & SpecString) >- return true; >- >- // If both sides are definitely only objects, then equality is fairly sane. >- if (isObjectSpeculation(a) && isObjectSpeculation(b)) >- return !!(a & b); >- >- // If either side could be an object or not, then we could call toString or >- // valueOf, which could return anything. >- if (a & SpecObject) >- return true; >- if (b & SpecObject) >- return true; >- >- // Neither side is an object or string, so the world is relatively sane. >- return !!(a & b); >-} >- > } // namespace JSC > >diff --git a/Source/JavaScriptCore/bytecode/SpeculatedType.h b/Source/JavaScriptCore/bytecode/SpeculatedType.h >index b280690c790a8dca67c22c794817f58fc165b618..eaf0af37a384652b53f0a83b1bf26043fcad67e7 100644 >--- a/Source/JavaScriptCore/bytecode/SpeculatedType.h >+++ b/Source/JavaScriptCore/bytecode/SpeculatedType.h >@@ -75,8 +75,7 @@ static const SpeculatedType SpecFullRealNumber = 0x07800000; // It's either > static const SpeculatedType SpecBytecodeNumber = 0x0e800000; // It's either an Int32 or a Double. > static const SpeculatedType SpecFullNumber = 0x0f800000; // It's either an Int32, Int52, or a Double. > static const SpeculatedType SpecBoolean = 0x10000000; // It's definitely a Boolean. >-static const SpeculatedType SpecOther = 0x20000000; // It's definitely either Null or Undefined. >-static const SpeculatedType SpecMisc = 0x30000000; // It's definitely either a boolean, Null, or Undefined. >+static const SpeculatedType SpecOther = 0x20000000; // It's definitely none of the above. > static const SpeculatedType SpecHeapTop = 0x3effffff; // It can be any of the above, except for SpecInt52. > static const SpeculatedType SpecEmpty = 0x40000000; // It's definitely an empty value marker. > static const SpeculatedType SpecBytecodeTop = 0x7effffff; // It can be any of the above, except for SpecInt52. >@@ -336,11 +335,6 @@ inline bool isOtherSpeculation(SpeculatedType value) > return value == SpecOther; > } > >-inline bool isMiscSpeculation(SpeculatedType value) >-{ >- return !!value && !(value & ~SpecMisc); >-} >- > inline bool isOtherOrEmptySpeculation(SpeculatedType value) > { > return !value || value == SpecOther; >@@ -388,10 +382,6 @@ SpeculatedType speculationFromValue(JSValue); > SpeculatedType speculationFromTypedArrayType(TypedArrayType); // only valid for typed views. > TypedArrayType typedArrayTypeFromSpeculation(SpeculatedType); > >-SpeculatedType leastUpperBoundOfStrictlyEquivalentSpeculations(SpeculatedType); >- >-bool valuesCouldBeEqual(SpeculatedType, SpeculatedType); >- > } // namespace JSC > > #endif // SpeculatedType_h >diff --git a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h >index dbf88ffb557f87f2f0d263e20d2ee3ba6a41e49c..32ed82f9037b73a1754102afcaa06486327c15c6 100644 >--- a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h >+++ b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h >@@ -917,7 +917,8 @@ bool AbstractInterpreter<AbstractStateType>::executeEffects(unsigned clobberLimi > if (node->op() == CompareEqConstant || node->op() == CompareEq) { > SpeculatedType leftType = forNode(node->child1()).m_type; > SpeculatedType rightType = forNode(node->child2()).m_type; >- if (!valuesCouldBeEqual(leftType, rightType)) { >+ if ((isInt32Speculation(leftType) && isOtherSpeculation(rightType)) >+ || (isOtherSpeculation(leftType) && isInt32Speculation(rightType))) { > setConstant(node, jsBoolean(false)); > break; > } >@@ -942,28 +943,19 @@ bool AbstractInterpreter<AbstractStateType>::executeEffects(unsigned clobberLimi > JSValue left = forNode(leftNode).value(); > JSValue right = forNode(rightNode).value(); > if (left && right) { >+ if (left.isNumber() && right.isNumber()) { >+ setConstant(node, jsBoolean(left.asNumber() == right.asNumber())); >+ break; >+ } > if (left.isString() && right.isString()) { >- // We need this case because JSValue::strictEqual is otherwise too racy for >- // string comparisons. > const StringImpl* a = asString(left)->tryGetValueImpl(); > const StringImpl* b = asString(right)->tryGetValueImpl(); > if (a && b) { > setConstant(node, jsBoolean(WTF::equal(a, b))); > break; > } >- } else { >- setConstant(node, jsBoolean(JSValue::strictEqual(0, left, right))); >- break; > } > } >- >- SpeculatedType leftLUB = leastUpperBoundOfStrictlyEquivalentSpeculations(forNode(leftNode).m_type); >- SpeculatedType rightLUB = leastUpperBoundOfStrictlyEquivalentSpeculations(forNode(rightNode).m_type); >- if (!(leftLUB & rightLUB)) { >- setConstant(node, jsBoolean(false)); >- break; >- } >- > forNode(node).setType(SpecBoolean); > node->setCanExit(true); // This is overly conservative. > break; >diff --git a/Source/JavaScriptCore/dfg/DFGArrayMode.cpp b/Source/JavaScriptCore/dfg/DFGArrayMode.cpp >index 9a93980dd9c1063246173d90955e9e037f90a412..1dd9f3154d65744faaa79258de42906c15d4f162 100644 >--- a/Source/JavaScriptCore/dfg/DFGArrayMode.cpp >+++ b/Source/JavaScriptCore/dfg/DFGArrayMode.cpp >@@ -1,5 +1,5 @@ > /* >- * Copyright (C) 2012, 2013, 2014 Apple Inc. All rights reserved. >+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved. > * > * Redistribution and use in source and binary forms, with or without > * modification, are permitted provided that the following conditions >@@ -132,7 +132,7 @@ ArrayMode ArrayMode::fromObserved(const ConcurrentJITLocker& locker, ArrayProfil > } > > ArrayMode ArrayMode::refine( >- Graph& graph, Node* node, >+ Graph& graph, CodeOrigin codeOrigin, > SpeculatedType base, SpeculatedType index, SpeculatedType value, > NodeFlags flags) const > { >@@ -199,18 +199,10 @@ ArrayMode ArrayMode::refine( > return withType(Array::Arguments); > > ArrayMode result; >- switch (node->op()) { >- case PutByVal: >- if (graph.hasExitSite(node->origin.semantic, OutOfBounds) || !isInBounds()) >- result = withSpeculation(Array::OutOfBounds); >- else >- result = withSpeculation(Array::InBounds); >- break; >- >- default: >+ if (graph.hasExitSite(codeOrigin, OutOfBounds) || !isInBounds()) >+ result = withSpeculation(Array::OutOfBounds); >+ else > result = withSpeculation(Array::InBounds); >- break; >- } > > if (isInt8ArraySpeculation(base)) > return result.withType(Array::Int8Array); >diff --git a/Source/JavaScriptCore/dfg/DFGArrayMode.h b/Source/JavaScriptCore/dfg/DFGArrayMode.h >index 9c67edbc8b0cadfbaae9bcbe8e2c974e6d82206f..add9215f6cba6888b81cb9610765f5d1056e6791 100644 >--- a/Source/JavaScriptCore/dfg/DFGArrayMode.h >+++ b/Source/JavaScriptCore/dfg/DFGArrayMode.h >@@ -1,5 +1,5 @@ > /* >- * Copyright (C) 2012, 2013, 2014 Apple Inc. All rights reserved. >+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved. > * > * Redistribution and use in source and binary forms, with or without > * modification, are permitted provided that the following conditions >@@ -220,7 +220,7 @@ public: > return ArrayMode(type, arrayClass(), speculation(), conversion); > } > >- ArrayMode refine(Graph&, Node*, SpeculatedType base, SpeculatedType index, SpeculatedType value = SpecNone, NodeFlags = 0) const; >+ ArrayMode refine(Graph&, CodeOrigin, SpeculatedType base, SpeculatedType index, SpeculatedType value = SpecNone, NodeFlags = 0) const; > > bool alreadyChecked(Graph&, Node*, AbstractValue&) const; > >diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp >index 5c0aa420c74b2101c0dce3797ad1080734e98605..b90c317496e6de531687e334a056036b41a2b64e 100644 >--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp >+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp >@@ -432,11 +432,6 @@ private: > fixEdge<ObjectUse>(node->child2()); > break; > } >- if (node->child1()->shouldSpeculateMisc() && node->child2()->shouldSpeculateMisc()) { >- fixEdge<MiscUse>(node->child1()); >- fixEdge<MiscUse>(node->child2()); >- break; >- } > break; > } > >@@ -457,7 +452,7 @@ private: > case GetByVal: { > node->setArrayMode( > node->arrayMode().refine( >- m_graph, node, >+ m_graph, node->origin.semantic, > node->child1()->prediction(), > node->child2()->prediction(), > SpecNone, node->flags())); >@@ -515,7 +510,7 @@ private: > > node->setArrayMode( > node->arrayMode().refine( >- m_graph, node, >+ m_graph, node->origin.semantic, > child1->prediction(), > child2->prediction(), > child3->prediction())); >@@ -601,7 +596,7 @@ private: > // that would break things. > node->setArrayMode( > node->arrayMode().refine( >- m_graph, node, >+ m_graph, node->origin.semantic, > node->child1()->prediction() & SpecCell, > SpecInt32, > node->child2()->prediction())); >@@ -1755,7 +1750,7 @@ private: > } > > arrayMode = arrayMode.refine( >- m_graph, node, node->child1()->prediction(), node->prediction()); >+ m_graph, node->origin.semantic, node->child1()->prediction(), node->prediction()); > > if (arrayMode.type() == Array::Generic) { > // Check if the input is something that we can't get array length for, but for which we >diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h >index b5b9590668dd9303ab99565e43f08dbf6e17e265..690f1f5747c1ba081235d0535f67526864a22e34 100644 >--- a/Source/JavaScriptCore/dfg/DFGNode.h >+++ b/Source/JavaScriptCore/dfg/DFGNode.h >@@ -1399,11 +1399,6 @@ struct Node { > { > return isBooleanSpeculation(prediction()); > } >- >- bool shouldSpeculateMisc() >- { >- return isMiscSpeculation(prediction()); >- } > > bool shouldSpeculateStringIdent() > { >diff --git a/Source/JavaScriptCore/dfg/DFGSafeToExecute.h b/Source/JavaScriptCore/dfg/DFGSafeToExecute.h >index 06c0d40e94d369996be9807e37c1ffa4ecf513f6..1bc1fbc1b37a6ac2bccc5b9abc78e3b84bcb6904 100644 >--- a/Source/JavaScriptCore/dfg/DFGSafeToExecute.h >+++ b/Source/JavaScriptCore/dfg/DFGSafeToExecute.h >@@ -59,7 +59,6 @@ public: > case StringOrStringObjectUse: > case NotCellUse: > case OtherUse: >- case MiscUse: > case MachineIntUse: > return; > >diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp >index 5a97c82a698aafd29acf2cb3209c2c0f9d24ca3e..417e7609a85609d9a2d1e61dcdb3103526fd116d 100644 >--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp >+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp >@@ -3802,11 +3802,6 @@ bool SpeculativeJIT::compileStrictEq(Node* node) > return false; > } > >- case MiscUse: { >- compileMiscStrictEq(node); >- return false; >- } >- > case UntypedUse: { > return nonSpeculativeStrictEq(node); > } >@@ -4835,31 +4830,6 @@ void SpeculativeJIT::speculateOther(Edge edge) > #endif > } > >-void SpeculativeJIT::speculateMisc(Edge edge, JSValueRegs regs) >-{ >-#if USE(JSVALUE64) >- typeCheck( >- regs, edge, SpecMisc, >- m_jit.branch64(MacroAssembler::Above, regs.gpr(), MacroAssembler::TrustedImm64(TagBitTypeOther | TagBitBool | TagBitUndefined))); >-#else >- typeCheck( >- regs, edge, SpecMisc | SpecInt32, >- m_jit.branch32(MacroAssembler::Equal, regs.tagGPR(), MacroAssembler::TrustedImm32(JSValue::Int32Tag))); >- typeCheck( >- regs, edge, SpecMisc, >- m_jit.branch32(MacroAssembler::Below, regs.tagGPR(), MacroAssembler::TrustedImm32(JSValue::UndefinedTag))); >-#endif >-} >- >-void SpeculativeJIT::speculateMisc(Edge edge) >-{ >- if (!needsTypeCheck(edge, SpecMisc)) >- return; >- >- JSValueOperand operand(this, edge, ManualOperandSpeculation); >- speculateMisc(edge, operand.jsValueRegs()); >-} >- > void SpeculativeJIT::speculate(Node*, Edge edge) > { > switch (edge.useKind()) { >@@ -4922,9 +4892,6 @@ void SpeculativeJIT::speculate(Node*, Edge edge) > case OtherUse: > speculateOther(edge); > break; >- case MiscUse: >- speculateMisc(edge); >- break; > default: > RELEASE_ASSERT_NOT_REACHED(); > break; >diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h >index df4f96db345f721d51971c5f7085242168ffbf13..391d1edd99afa3d8e8648da82f5ac0b0115e3677 100644 >--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h >+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h >@@ -1985,7 +1985,6 @@ public: > void compileStringEquality(Node*); > void compileStringIdentEquality(Node*); > void compileStringZeroLength(Node*); >- void compileMiscStrictEq(Node*); > > void emitObjectOrOtherBranch(Edge value, BasicBlock* taken, BasicBlock* notTaken); > void emitBranch(Node*); >@@ -2204,8 +2203,6 @@ public: > void speculateStringOrStringObject(Edge); > void speculateNotCell(Edge); > void speculateOther(Edge); >- void speculateMisc(Edge, JSValueRegs); >- void speculateMisc(Edge); > void speculate(Node*, Edge); > > JITCompiler::Jump jumpSlowForUnwantedArrayMode(GPRReg tempWithIndexingTypeReg, ArrayMode, IndexingType); >diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp >index 9e0097a6ff967bc94b527563cb43c95ae1945b50..1cf356c1462ced55f16884b437516cbb3ab0e7ce 100644 >--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp >+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp >@@ -613,22 +613,6 @@ void SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq(Node* node, bool invert) > booleanResult(resultPayloadGPR, node, UseChildrenCalledExplicitly); > } > >-void SpeculativeJIT::compileMiscStrictEq(Node* node) >-{ >- JSValueOperand op1(this, node->child1(), ManualOperandSpeculation); >- JSValueOperand op2(this, node->child2(), ManualOperandSpeculation); >- GPRTemporary result(this); >- >- speculateMisc(node->child1(), op1.jsValueRegs()); >- speculateMisc(node->child2(), op2.jsValueRegs()); >- >- m_jit.move(TrustedImm32(0), result.gpr()); >- JITCompiler::Jump notEqual = m_jit.branch32(JITCompiler::NotEqual, op1.tagGPR(), op2.tagGPR()); >- m_jit.compare32(JITCompiler::Equal, op1.payloadGPR(), op2.payloadGPR(), result.gpr()); >- notEqual.link(&m_jit); >- booleanResult(result.gpr(), node); >-} >- > void SpeculativeJIT::emitCall(Node* node) > { > if (node->op() != Call) >diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp >index c3c95db93accd1402d8fb368d31a4f3b3d664805..475b4db6eed1ada57b9c66e23134afc443fbc9a7 100644 >--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp >+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp >@@ -648,20 +648,6 @@ void SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq(Node* node, bool invert) > jsValueResult(resultGPR, m_currentNode, DataFormatJSBoolean, UseChildrenCalledExplicitly); > } > >-void SpeculativeJIT::compileMiscStrictEq(Node* node) >-{ >- JSValueOperand op1(this, node->child1(), ManualOperandSpeculation); >- JSValueOperand op2(this, node->child2(), ManualOperandSpeculation); >- GPRTemporary result(this); >- >- speculateMisc(node->child1(), op1.jsValueRegs()); >- speculateMisc(node->child2(), op2.jsValueRegs()); >- >- m_jit.compare32(JITCompiler::Equal, op1.gpr(), op2.gpr(), result.gpr()); >- m_jit.or32(TrustedImm32(ValueFalse), result.gpr()); >- jsValueResult(result.gpr(), node, DataFormatJSBoolean); >-} >- > void SpeculativeJIT::emitCall(Node* node) > { > if (node->op() != Call) >diff --git a/Source/JavaScriptCore/dfg/DFGUseKind.cpp b/Source/JavaScriptCore/dfg/DFGUseKind.cpp >index b7a5c6fa15773e6a2ff5e70806ace9982fcd6d66..4e6df98377a2f5bc316fa979c648dc060f0f6977 100644 >--- a/Source/JavaScriptCore/dfg/DFGUseKind.cpp >+++ b/Source/JavaScriptCore/dfg/DFGUseKind.cpp >@@ -1,5 +1,5 @@ > /* >- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved. >+ * Copyright (C) 2013 Apple Inc. All rights reserved. > * > * Redistribution and use in source and binary forms, with or without > * modification, are permitted provided that the following conditions >@@ -97,9 +97,6 @@ void printInternal(PrintStream& out, UseKind useKind) > case OtherUse: > out.print("Other"); > break; >- case MiscUse: >- out.print("Misc"); >- break; > default: > RELEASE_ASSERT_NOT_REACHED(); > break; >diff --git a/Source/JavaScriptCore/dfg/DFGUseKind.h b/Source/JavaScriptCore/dfg/DFGUseKind.h >index f66d143dbbf2d6f286e5cc7db0abe1135241ccb9..dfa82ee5b53da324a579e68b58a279159ad1a171 100644 >--- a/Source/JavaScriptCore/dfg/DFGUseKind.h >+++ b/Source/JavaScriptCore/dfg/DFGUseKind.h >@@ -1,5 +1,5 @@ > /* >- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved. >+ * Copyright (C) 2013 Apple Inc. All rights reserved. > * > * Redistribution and use in source and binary forms, with or without > * modification, are permitted provided that the following conditions >@@ -54,7 +54,6 @@ enum UseKind { > StringOrStringObjectUse, > NotCellUse, > OtherUse, >- MiscUse, > LastUseKind // Must always be the last entry in the enum, as it is used to denote the number of enum elements. > }; > >@@ -97,8 +96,6 @@ ALWAYS_INLINE SpeculatedType typeFilterFor(UseKind useKind) > return ~SpecCell; > case OtherUse: > return SpecOther; >- case MiscUse: >- return SpecMisc; > default: > RELEASE_ASSERT_NOT_REACHED(); > return SpecFullTop; >diff --git a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp >index b7ee25cc5b1134444aba3fe917ccad54e470338a..435c0320bfc711671239e28b2e1c03715efe8eef 100644 >--- a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp >+++ b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp >@@ -141,9 +141,6 @@ inline CapabilityLevel canCompile(Node* node) > case MultiPutByOffset: > case ToPrimitive: > case PhantomArguments: >- case Throw: >- case ThrowReferenceError: >- case Unreachable: > case GetMyArgumentByVal: > // These are OK. > break; >@@ -236,8 +233,6 @@ inline CapabilityLevel canCompile(Node* node) > break; > if (node->isBinaryUseKind(UntypedUse)) > break; >- if (node->isBinaryUseKind(BooleanUse)) >- break; > if (node->child1().useKind() == ObjectUse > && node->child2().useKind() == ObjectOrOtherUse) > break; >@@ -254,10 +249,6 @@ inline CapabilityLevel canCompile(Node* node) > break; > if (node->isBinaryUseKind(ObjectUse)) > break; >- if (node->isBinaryUseKind(MiscUse)) >- break; >- if (node->isBinaryUseKind(BooleanUse)) >- break; > return CannotCompile; > case CompareLess: > case CompareLessEq: >@@ -350,7 +341,6 @@ CapabilityLevel canCompile(Graph& graph) > case StringOrStringObjectUse: > case FinalObjectUse: > case NotCellUse: >- case MiscUse: > // These are OK. > break; > default: >diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp >index 9756dbb31ba111294cb3a2de1187bf8048ebfb94..31c38e3097d06542e8cd7a8ade453e0f1aa888d1 100644 >--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp >+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp >@@ -559,10 +559,6 @@ private: > case ForceOSRExit: > compileForceOSRExit(); > break; >- case Throw: >- case ThrowReferenceError: >- compileThrow(); >- break; > case InvalidationPoint: > compileInvalidationPoint(); > break; >@@ -596,9 +592,6 @@ private: > case TypedArrayWatchpoint: > case AllocationProfileWatchpoint: > break; >- case Unreachable: >- RELEASE_ASSERT_NOT_REACHED(); >- break; > default: > RELEASE_ASSERT_NOT_REACHED(); > break; >@@ -3369,8 +3362,7 @@ private: > if (m_node->isBinaryUseKind(Int32Use) > || m_node->isBinaryUseKind(MachineIntUse) > || m_node->isBinaryUseKind(NumberUse) >- || m_node->isBinaryUseKind(ObjectUse) >- || m_node->isBinaryUseKind(BooleanUse)) { >+ || m_node->isBinaryUseKind(ObjectUse)) { > compileCompareStrictEq(); > return; > } >@@ -3433,21 +3425,6 @@ private: > return; > } > >- if (m_node->isBinaryUseKind(BooleanUse)) { >- setBoolean( >- m_out.equal(lowBoolean(m_node->child1()), lowBoolean(m_node->child2()))); >- return; >- } >- >- if (m_node->isBinaryUseKind(MiscUse)) { >- LValue left = lowJSValue(m_node->child1(), ManualOperandSpeculation); >- LValue right = lowJSValue(m_node->child2(), ManualOperandSpeculation); >- FTL_TYPE_CHECK(jsValueValue(left), m_node->child1(), SpecMisc, isNotMisc(left)); >- FTL_TYPE_CHECK(jsValueValue(right), m_node->child2(), SpecMisc, isNotMisc(right)); >- setBoolean(m_out.equal(left, right)); >- return; >- } >- > RELEASE_ASSERT_NOT_REACHED(); > } > >@@ -3714,11 +3691,6 @@ private: > terminate(InadequateCoverage); > } > >- void compileThrow() >- { >- terminate(Uncountable); >- } >- > void compileInvalidationPoint() > { > if (verboseCompilationEnabled()) >@@ -4991,16 +4963,6 @@ private: > return m_out.testIsZero64(jsValue, m_tagMask); > } > >- LValue isNotMisc(LValue value) >- { >- return m_out.above(value, m_out.constInt64(TagBitTypeOther | TagBitBool | TagBitUndefined)); >- } >- >- LValue isMisc(LValue value) >- { >- return m_out.bitNot(isNotMisc(value)); >- } >- > LValue isNotBoolean(LValue jsValue) > { > return m_out.testNonZero64( >@@ -5084,9 +5046,6 @@ private: > case NotCellUse: > speculateNotCell(edge); > break; >- case MiscUse: >- speculateMisc(edge); >- break; > default: > dataLog("Unsupported speculation use kind: ", edge.useKind(), "\n"); > RELEASE_ASSERT_NOT_REACHED(); >@@ -5364,15 +5323,6 @@ private: > typeCheck(jsValueValue(value), edge, ~SpecCell, isCell(value)); > } > >- void speculateMisc(Edge edge) >- { >- if (!m_interpreter.needsTypeCheck(edge)) >- return; >- >- LValue value = lowJSValue(edge); >- typeCheck(jsValueValue(value), edge, SpecMisc, isNotMisc(value)); >- } >- > bool masqueradesAsUndefinedWatchpointIsStillValid() > { > return m_graph.masqueradesAsUndefinedWatchpointIsStillValid(m_node->origin.semantic); >diff --git a/Source/JavaScriptCore/tests/stress/float32-array-out-of-bounds.js b/Source/JavaScriptCore/tests/stress/float32-array-out-of-bounds.js >deleted file mode 100644 >index b50765d7c082b7f5c4188b44dc2198e90039c79c..0000000000000000000000000000000000000000 >--- a/Source/JavaScriptCore/tests/stress/float32-array-out-of-bounds.js >+++ /dev/null >@@ -1,23 +0,0 @@ >-function foo(a) { >- return a[42]; >-} >- >-noInline(foo); >- >-var shortArray = new Float32Array(10); >-var longArray = new Float32Array(100); >- >-function test(array, expected) { >- var result = foo(array); >- if (result != expected) >- throw new Error("bad result: " + result); >-} >- >-for (var i = 0; i < 1000; ++i) >- test(shortArray, void 0); >- >-for (var i = 0; i < 100000; ++i) >- test(longArray, 0); >- >-test(shortArray, void 0); >- >diff --git a/Source/JavaScriptCore/tests/stress/weird-equality-folding-cases.js b/Source/JavaScriptCore/tests/stress/weird-equality-folding-cases.js >deleted file mode 100644 >index d2c618ee9d983cf607cd595ca430c0f4bc7ea76a..0000000000000000000000000000000000000000 >--- a/Source/JavaScriptCore/tests/stress/weird-equality-folding-cases.js >+++ /dev/null >@@ -1,13 +0,0 @@ >-function test(actualFunction, expected) { >- var actual = actualFunction(); >- if (actual != expected) >- throw new Error("bad in " + actualFunction + " result: " + actual); >-} >- >-noInline(test); >- >-for (var i = 0; i < 10000; ++i) { >- test(function() { return "5" == 5; }, true); >- test(function() { return ({valueOf:function(){return 42;}}) == 42; }, true); >- test(function() { return ({valueOf:function(){return 42;}}) == ({valueOf:function(){return 42;}}) }, false); >-} >diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog >index 1d7d67d111cfa1d9be7e9aaa573106f0afd6a92a..b17461514131a5d4f95cc1b12aed272f53655130 100644 >--- a/LayoutTests/ChangeLog >+++ b/LayoutTests/ChangeLog >@@ -1,3 +1,19 @@ >+2014-03-04 Commit Queue <commit-queue@webkit.org> >+ >+ Unreviewed, rolling out r165085. >+ http://trac.webkit.org/changeset/165085 >+ https://bugs.webkit.org/show_bug.cgi?id=129729 >+ >+ Broke imported/w3c/html-templates/template-element/template- >+ content.html (Requested by ap on #webkit). >+ >+ * js/regress/fold-strict-eq-expected.txt: Removed. >+ * js/regress/fold-strict-eq.html: Removed. >+ * js/regress/misc-strict-eq-expected.txt: Removed. >+ * js/regress/misc-strict-eq.html: Removed. >+ * js/regress/script-tests/fold-strict-eq.js: Removed. >+ * js/regress/script-tests/misc-strict-eq.js: Removed. >+ > 2014-03-04 Zalan Bujtas <zalan@apple.com> > > Enable device pixel repaint rect tracking. >diff --git a/LayoutTests/js/regress/fold-strict-eq-expected.txt b/LayoutTests/js/regress/fold-strict-eq-expected.txt >deleted file mode 100644 >index b66c610070cdd22669eb92a7684be222595ed142..0000000000000000000000000000000000000000 >--- a/LayoutTests/js/regress/fold-strict-eq-expected.txt >+++ /dev/null >@@ -1,10 +0,0 @@ >-JSRegress/fold-strict-eq >- >-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE". >- >- >-PASS no exception thrown >-PASS successfullyParsed is true >- >-TEST COMPLETE >- >diff --git a/LayoutTests/js/regress/fold-strict-eq.html b/LayoutTests/js/regress/fold-strict-eq.html >deleted file mode 100644 >index 9c262aabc85095d42a7d2db28bd14f38f27eca9e..0000000000000000000000000000000000000000 >--- a/LayoutTests/js/regress/fold-strict-eq.html >+++ /dev/null >@@ -1,12 +0,0 @@ >-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> >-<html> >-<head> >-<script src="../../resources/js-test-pre.js"></script> >-</head> >-<body> >-<script src="resources/regress-pre.js"></script> >-<script src="script-tests/fold-strict-eq.js"></script> >-<script src="resources/regress-post.js"></script> >-<script src="../../resources/js-test-post.js"></script> >-</body> >-</html> >diff --git a/LayoutTests/js/regress/misc-strict-eq-expected.txt b/LayoutTests/js/regress/misc-strict-eq-expected.txt >deleted file mode 100644 >index b47c309d1409fe61fa9f98a1917f64327379b239..0000000000000000000000000000000000000000 >--- a/LayoutTests/js/regress/misc-strict-eq-expected.txt >+++ /dev/null >@@ -1,10 +0,0 @@ >-JSRegress/misc-strict-eq >- >-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE". >- >- >-PASS no exception thrown >-PASS successfullyParsed is true >- >-TEST COMPLETE >- >diff --git a/LayoutTests/js/regress/misc-strict-eq.html b/LayoutTests/js/regress/misc-strict-eq.html >deleted file mode 100644 >index 883c695a28d34b90c2aa09574b1e4e7436e5ad82..0000000000000000000000000000000000000000 >--- a/LayoutTests/js/regress/misc-strict-eq.html >+++ /dev/null >@@ -1,12 +0,0 @@ >-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> >-<html> >-<head> >-<script src="../../resources/js-test-pre.js"></script> >-</head> >-<body> >-<script src="resources/regress-pre.js"></script> >-<script src="script-tests/misc-strict-eq.js"></script> >-<script src="resources/regress-post.js"></script> >-<script src="../../resources/js-test-post.js"></script> >-</body> >-</html> >diff --git a/LayoutTests/js/regress/script-tests/fold-strict-eq.js b/LayoutTests/js/regress/script-tests/fold-strict-eq.js >deleted file mode 100644 >index 0d83e6611d3c77cb9fec022e8f5314d0553f7467..0000000000000000000000000000000000000000 >--- a/LayoutTests/js/regress/script-tests/fold-strict-eq.js >+++ /dev/null >@@ -1,16 +0,0 @@ >-function foo(a, b) { >- return a === b; >-} >- >-function test(actual, expected) { >- if (actual !== expected) >- throw new Error("bad result: " + actual); >-} >- >-for (var i = 0; i < 10000000; ++i) { >- test(foo(true, null), false); >- test(foo(true, false), false); >- test(foo(true, true), true); >- test(foo(5, "hello"), false); >- test(foo(void 0, new Object()), false); >-} >diff --git a/LayoutTests/js/regress/script-tests/misc-strict-eq.js b/LayoutTests/js/regress/script-tests/misc-strict-eq.js >deleted file mode 100644 >index 05913d33871282d54432c0d1023484c2fb4b8c78..0000000000000000000000000000000000000000 >--- a/LayoutTests/js/regress/script-tests/misc-strict-eq.js >+++ /dev/null >@@ -1,13 +0,0 @@ >-(function() { >- var array = [true, false, null, void 0]; >- for (var i = 0; i < 1000000; ++i) { >- for (var j = 0; j < array.length; ++j) { >- for (var k = j ; k < array.length; ++k) { >- var actual = array[j] === array[k]; >- var expected = j == k; >- if (actual != expected) >- throw "Error: bad result for j = " + j + ", k = " + k; >- } >- } >- } >-})();
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=225861">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 129729
: 225861