Attachment 362428 Details for Bug 194625 – Patch

[patch] Patch

patch194625 (text/plain), 2.36 KB, created by Robin Morisset on 2019-02-19 14:21:06 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Robin Morisset

Created: 2019-02-19 14:21:06 PST

Size: 2.36 KB

patch

obsolete

>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 2037305202e..82a4ea60081 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,19 @@
>+2019-02-19  Robin Morisset  <rmorisset@apple.com>
>+
>+        B3-O2 incorrectly optimizes this subtest
>+        https://bugs.webkit.org/show_bug.cgi?id=194625
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Trivial fix. Instead of doing
>+            if (!cond) foo else bar => if (cond) bar else foo
>+        B3LowerToAir was doing
>+            if (x^C) foo else bar => if (cond) bar else foo whenever C&1, even if C was for example 3.
>+
>+        * b3/B3LowerToAir.cpp:
>+        * b3/testb3.cpp:
>+        (JSC::B3::testBitNotOnBooleanAndBranch32):
>+
> 2019-02-18  Yusuke Suzuki  <ysuzuki@apple.com>
> 
>         [JSC] Introduce JSNonDestructibleProxy for JavaScriptCore.framework's GlobalThis
>diff --git a/Source/JavaScriptCore/b3/B3LowerToAir.cpp b/Source/JavaScriptCore/b3/B3LowerToAir.cpp
>index ba156bd25f9..1b3a92e5226 100644
>--- a/Source/JavaScriptCore/b3/B3LowerToAir.cpp
>+++ b/Source/JavaScriptCore/b3/B3LowerToAir.cpp
>@@ -1438,7 +1438,7 @@ private:
>         // we do need at least one iteration of it for Check.
>         for (;;) {
>             bool shouldInvert =
>-                (value->opcode() == BitXor && value->child(1)->hasInt() && (value->child(1)->asInt() & 1) && value->child(0)->returnsBool())
>+                (value->opcode() == BitXor && value->child(1)->hasInt() && (value->child(1)->asInt() == 1) && value->child(0)->returnsBool())
>                 || (value->opcode() == Equal && value->child(1)->isInt(0));
>             if (!shouldInvert)
>                 break;
>diff --git a/Source/JavaScriptCore/b3/testb3.cpp b/Source/JavaScriptCore/b3/testb3.cpp
>index b080e0dc50a..179cb8e3d22 100644
>--- a/Source/JavaScriptCore/b3/testb3.cpp
>+++ b/Source/JavaScriptCore/b3/testb3.cpp
>@@ -3534,7 +3534,7 @@ void testBitNotOnBooleanAndBranch32(int64_t a, int64_t b)
>         root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
>     Value* argsAreEqual = root->appendNew<Value>(proc, Equal, Origin(), arg1, arg2);
>     Value* argsAreNotEqual = root->appendNew<Value>(proc, BitXor, Origin(),
>-        root->appendNew<Const32Value>(proc, Origin(), -1),
>+        root->appendNew<Const32Value>(proc, Origin(), 1),
>         argsAreEqual);
> 
>     root->appendNewControlValue(

Flags:

saam: review+
saam: commit-queue-

Actions: View | Formatted Diff | Diff

Attachments on bug 194625: 362428 | 362436