WebKit Bugzilla
Attachment 360877 Details for
Bug 194130
: Remove invalid assertion in DFG's compileDoubleRep().
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
patch for landing.
bug-194130.patch (text/plain), 2.74 KB, created by
Mark Lam
on 2019-02-01 11:27:41 PST
(
hide
)
Description:
patch for landing.
Filename:
MIME Type:
Creator:
Mark Lam
Created:
2019-02-01 11:27:41 PST
Size:
2.74 KB
patch
obsolete
>Index: JSTests/ChangeLog >=================================================================== >--- JSTests/ChangeLog (revision 240859) >+++ JSTests/ChangeLog (working copy) >@@ -1,3 +1,13 @@ >+2019-02-01 Mark Lam <mark.lam@apple.com> >+ >+ Remove invalid assertion in DFG's compileDoubleRep(). >+ https://bugs.webkit.org/show_bug.cgi?id=194130 >+ <rdar://problem/47699474> >+ >+ Reviewed by Saam Barati. >+ >+ * stress/constant-fold-double-rep-into-double-constant.js: Added. >+ > 2019-01-30 Ross Kirsling <ross.kirsling@sony.com> > > Import latest Test262 updates. >Index: JSTests/stress/constant-fold-double-rep-into-double-constant.js >=================================================================== >--- JSTests/stress/constant-fold-double-rep-into-double-constant.js (nonexistent) >+++ JSTests/stress/constant-fold-double-rep-into-double-constant.js (working copy) >@@ -0,0 +1,14 @@ >+function bar(o) { >+ for (let i = 0; i < 2; i++) >+ o[i] = undefined; >+ o.length = undefined; >+ return o; >+} >+ >+function foo(a) { >+ bar(a); >+ undefined + bar(0) + bar(0); >+ for(let i = 0; i < 10000000; i++) {} >+} >+ >+foo({}); >Index: Source/JavaScriptCore/ChangeLog >=================================================================== >--- Source/JavaScriptCore/ChangeLog (revision 240858) >+++ Source/JavaScriptCore/ChangeLog (working copy) >@@ -1,3 +1,14 @@ >+2019-02-01 Mark Lam <mark.lam@apple.com> >+ >+ Remove invalid assertion in DFG's compileDoubleRep(). >+ https://bugs.webkit.org/show_bug.cgi?id=194130 >+ <rdar://problem/47699474> >+ >+ Reviewed by Saam Barati. >+ >+ * dfg/DFGSpeculativeJIT.cpp: >+ (JSC::DFG::SpeculativeJIT::compileDoubleRep): >+ > 2019-01-31 Mark Lam <mark.lam@apple.com> > > Remove poisoning from CodeBlock and LLInt code. >Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp >=================================================================== >--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (revision 240858) >+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (working copy) >@@ -1,5 +1,5 @@ > /* >- * Copyright (C) 2011-2018 Apple Inc. All rights reserved. >+ * Copyright (C) 2011-2019 Apple Inc. All rights reserved. > * > * Redistribution and use in source and binary forms, with or without > * modification, are permitted provided that the following conditions >@@ -2585,8 +2585,6 @@ void SpeculativeJIT::compileDoubleRep(No > > case NotCellUse: > case NumberUse: { >- ASSERT(!node->child1()->isNumberConstant()); // This should have been constant folded. >- > SpeculatedType possibleTypes = m_state.forNode(node->child1()).m_type; > if (isInt32Speculation(possibleTypes)) { > SpeculateInt32Operand op1(this, node->child1(), ManualOperandSpeculation);
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 194130
:
360815
| 360877