Attachment #195144 for bug #112106

View Details Raw Unified Return to Bug 112106



2013-03-26  Mark Hahnenberg  <mhahnenberg@apple.com>

        REGRESSION(r144131): It made fast/js/regress/string-repeat-arith.html assert on 32 bit
        https://bugs.webkit.org/show_bug.cgi?id=112106

        Reviewed by NOBODY (OOPS!).

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32): We now just set m_compileOkay to false and return.
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): Fixed a random compile error with this flag enabled.

2013-03-25  Filip Pizlo  <fpizlo@apple.com>

        ArrayMode should not consider SpecOther when refining the base

Lines 1173-1179 GPRReg SpeculativeJIT::fillSpeculateCell Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp_sec1
- Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp -1 / +1 lines
1173	GPRReg SpeculativeJIT::fillSpeculateBoolean(Edge edge)	1173	GPRReg SpeculativeJIT::fillSpeculateBoolean(Edge edge)
1174	{	1174	{
1175	#if DFG_ENABLE(DEBUG_VERBOSE)	1175	#if DFG_ENABLE(DEBUG_VERBOSE)
1176	dataLogF("SpecBool@%d ", node->index());	1176	dataLogF("SpecBool@%d ", edge.node()->index());
1177	#endif	1177	#endif
1178	AbstractValue& value = m_state.forNode(edge);	1178	AbstractValue& value = m_state.forNode(edge);
1179	SpeculatedType type = value.m_type;	1179	SpeculatedType type = value.m_type;

Lines 2104-2110 GeneratedOperandType SpeculativeJIT::che Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec1
- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp -1 / +1 lines
2104	if (isNumberConstant(node))	2104	if (isNumberConstant(node))
2105	return GeneratedOperandDouble;	2105	return GeneratedOperandDouble;
2106		2106
2107	terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);	2107	m_compileOkay = false;
2108	return GeneratedOperandTypeUnknown;	2108	return GeneratedOperandTypeUnknown;
2109	}	2109	}
2110		2110

Return to Bug 112106

Lines 1-3 Source/JavaScriptCore/ChangeLog_sec1
- Source/JavaScriptCore/ChangeLog +12 lines
		1	2013-03-26 Mark Hahnenberg <mhahnenberg@apple.com>
		2
		3	REGRESSION(r144131): It made fast/js/regress/string-repeat-arith.html assert on 32 bit
		4	https://bugs.webkit.org/show_bug.cgi?id=112106
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	* dfg/DFGSpeculativeJIT.cpp:
		9	(JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32): We now just set m_compileOkay to false and return.
		10	* dfg/DFGSpeculativeJIT32_64.cpp:
		11	(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): Fixed a random compile error with this flag enabled.
		12
1	2013-03-25 Filip Pizlo <fpizlo@apple.com>	13	2013-03-25 Filip Pizlo <fpizlo@apple.com>
2		14
3	ArrayMode should not consider SpecOther when refining the base	15	ArrayMode should not consider SpecOther when refining the base