Attachment 357768 Details for Bug 192908 – Patch

[patch] Patch

bug-192908-20181220001935.patch (text/plain), 1.64 KB, created by Caio Lima on 2018-12-19 18:19:36 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Caio Lima

Created: 2018-12-19 18:19:36 PST

Size: 1.64 KB

patch

obsolete

>Subversion Revision: 239377
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 061d90bf7ea8e8524f26e5d24178db7123fed7be..7e11b0f60b2cee193688909696f09b1002441fa0 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,17 @@
>+2018-12-19  Caio Lima  <ticaiolima@gmail.com>
>+
>+        StrengthReductionPhase ValueAdd rule handles BigInt handleCommutativity is breaking JSC::DFG::Edge::useKind()
>+        https://bugs.webkit.org/show_bug.cgi?id=192908
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Current rule is considering that both operands of ValueAdd have nodes,
>+        but this is not quite true. In such case, we are checking the
>+        existence of both nodes before using m_node->binaryUseKind.
>+
>+        * dfg/DFGStrengthReductionPhase.cpp:
>+        (JSC::DFG::StrengthReductionPhase::handleNode):
>+
> 2018-12-19  Caio Lima  <ticaiolima@gmail.com>
> 
>         [BigInt] We should enable CSE into arithmetic operations that speculate BigIntUse
>diff --git a/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp b/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp
>index 95c6e739b57c9c5ed783d262f4b296807bc9f7f9..a8e3913d302d1af53a784466776f4b965485f642 100644
>--- a/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp
>@@ -374,7 +374,7 @@ private:
>                 m_changed = true;
>             }
> 
>-            if (m_node->binaryUseKind() == BigIntUse)
>+            if (m_node->child1().node() && m_node->child2().node() && m_node->binaryUseKind() == BigIntUse)
>                 handleCommutativity();
> 
>             break;

Flags:

ysuzuki: review-

Actions: View | Formatted Diff | Diff

Attachments on bug 192908: 357768