Attachment 360877 Details for Bug 194130 – patch for landing.

[patch] patch for landing.

bug-194130.patch (text/plain), 2.74 KB, created by Mark Lam on 2019-02-01 11:27:41 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Mark Lam

Created: 2019-02-01 11:27:41 PST

Size: 2.74 KB

patch

obsolete

>Index: JSTests/ChangeLog
>===================================================================
>--- JSTests/ChangeLog	(revision 240859)
>+++ JSTests/ChangeLog	(working copy)
>@@ -1,3 +1,13 @@
>+2019-02-01  Mark Lam  <mark.lam@apple.com>
>+
>+        Remove invalid assertion in DFG's compileDoubleRep().
>+        https://bugs.webkit.org/show_bug.cgi?id=194130
>+        <rdar://problem/47699474>
>+
>+        Reviewed by Saam Barati.
>+
>+        * stress/constant-fold-double-rep-into-double-constant.js: Added.
>+
> 2019-01-30  Ross Kirsling  <ross.kirsling@sony.com>
> 
>         Import latest Test262 updates.
>Index: JSTests/stress/constant-fold-double-rep-into-double-constant.js
>===================================================================
>--- JSTests/stress/constant-fold-double-rep-into-double-constant.js	(nonexistent)
>+++ JSTests/stress/constant-fold-double-rep-into-double-constant.js	(working copy)
>@@ -0,0 +1,14 @@
>+function bar(o) {
>+    for (let i = 0; i < 2; i++)
>+        o[i] = undefined;
>+    o.length = undefined;
>+    return o;
>+}
>+
>+function foo(a) {
>+    bar(a);
>+    undefined + bar(0) + bar(0);
>+    for(let i = 0; i < 10000000; i++) {}
>+}
>+
>+foo({});
>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 240858)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,14 @@
>+2019-02-01  Mark Lam  <mark.lam@apple.com>
>+
>+        Remove invalid assertion in DFG's compileDoubleRep().
>+        https://bugs.webkit.org/show_bug.cgi?id=194130
>+        <rdar://problem/47699474>
>+
>+        Reviewed by Saam Barati.
>+
>+        * dfg/DFGSpeculativeJIT.cpp:
>+        (JSC::DFG::SpeculativeJIT::compileDoubleRep):
>+
> 2019-01-31  Mark Lam  <mark.lam@apple.com>
> 
>         Remove poisoning from CodeBlock and LLInt code.
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(revision 240858)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2011-2018 Apple Inc. All rights reserved.
>+ * Copyright (C) 2011-2019 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -2585,8 +2585,6 @@ void SpeculativeJIT::compileDoubleRep(No
>     
>     case NotCellUse:
>     case NumberUse: {
>-        ASSERT(!node->child1()->isNumberConstant()); // This should have been constant folded.
>-
>         SpeculatedType possibleTypes = m_state.forNode(node->child1()).m_type;
>         if (isInt32Speculation(possibleTypes)) {
>             SpeculateInt32Operand op1(this, node->child1(), ManualOperandSpeculation);

Actions: View | Formatted Diff | Diff

Attachments on bug 194130: 360815 | 360877