Attachment 360815 Details for Bug 194130 – proposed patch.

[patch] proposed patch.

bug-194130.patch (text/plain), 3.48 KB, created by Mark Lam on 2019-01-31 17:30:53 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Mark Lam

Created: 2019-01-31 17:30:53 PST

Size: 3.48 KB

patch

obsolete

>Index: JSTests/ChangeLog
>===================================================================
>--- JSTests/ChangeLog	(revision 240831)
>+++ JSTests/ChangeLog	(working copy)
>@@ -1,3 +1,13 @@
>+2019-01-31  Mark Lam  <mark.lam@apple.com>
>+
>+        Constant fold DoubleRep of a numeric constant into a DoubleConstant.
>+        https://bugs.webkit.org/show_bug.cgi?id=194130
>+        <rdar://problem/47699474>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * stress/constant-fold-double-rep-into-double-constant.js: Added.
>+
> 2019-01-30  Ross Kirsling  <ross.kirsling@sony.com>
> 
>         Import latest Test262 updates.
>Index: JSTests/stress/constant-fold-double-rep-into-double-constant.js
>===================================================================
>--- JSTests/stress/constant-fold-double-rep-into-double-constant.js	(nonexistent)
>+++ JSTests/stress/constant-fold-double-rep-into-double-constant.js	(working copy)
>@@ -0,0 +1,14 @@
>+function bar(o) {
>+    for (let i = 0; i < 2; i++)
>+        o[i] = undefined;
>+    o.length = undefined;
>+    return o;
>+}
>+
>+function foo(a) {
>+    bar(a);
>+    undefined + bar(0) + bar(0);
>+    for(let i = 0; i < 10000000; i++) {}
>+}
>+
>+foo({});
>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 240812)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,18 @@
>+2019-01-31  Mark Lam  <mark.lam@apple.com>
>+
>+        Constant fold DoubleRep of a numeric constant into a DoubleConstant.
>+        https://bugs.webkit.org/show_bug.cgi?id=194130
>+        <rdar://problem/47699474>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Also remove an invalid assertion in DFG's compileDoubleRep().
>+
>+        * dfg/DFGConstantFoldingPhase.cpp:
>+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
>+        * dfg/DFGSpeculativeJIT.cpp:
>+        (JSC::DFG::SpeculativeJIT::compileDoubleRep):
>+
> 2019-01-31  Yusuke Suzuki  <ysuzuki@apple.com>
> 
>         Unreviewed, follow-up after r240796
>Index: Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp	(revision 240812)
>+++ Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp	(working copy)
>@@ -788,6 +788,14 @@ private:
>                 break;
>             }
> 
>+            case DoubleRep: {
>+                if (node->child1()->isNumberConstant()) {
>+                    m_graph.convertToConstant(node, JSValue(node->child1()->asNumber()));
>+                    changed = true;
>+                }
>+                break;
>+            }
>+
>             case NormalizeMapKey: {
>                 SpeculatedType typeMaybeNormalized = (SpecFullNumber & ~SpecInt32Only);
>                 if (m_state.forNode(node->child1()).m_type & typeMaybeNormalized)
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(revision 240812)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(working copy)
>@@ -2585,8 +2585,6 @@ void SpeculativeJIT::compileDoubleRep(No
>     
>     case NotCellUse:
>     case NumberUse: {
>-        ASSERT(!node->child1()->isNumberConstant()); // This should have been constant folded.
>-
>         SpeculatedType possibleTypes = m_state.forNode(node->child1()).m_type;
>         if (isInt32Speculation(possibleTypes)) {
>             SpeculateInt32Operand op1(this, node->child1(), ManualOperandSpeculation);

Flags:

saam: review+
ews-watchlist: commit-queue-

Actions: View | Formatted Diff | Diff

Attachments on bug 194130: 360815 | 360877