Bug 133918

Summary:

DFG AI and constant folder should be able to precisely prune MultiGetByOffset/MultiPutByOffset even if the base structure abstract value is not a singleton

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

JavaScriptCore

Assignee:

Filip Pizlo <fpizlo>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

barraclough, ggaren, mark.lam, mhahnenberg, msaboff, oliver, sam

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Bug Depends on:

133935, 133947, 133985

Bug Blocks:

133229

Attachments:

Description	Flags
work in progress	none
more	none
rebased	none
it compiles!	none
almost done	none
ready for review	mhahnenberg: review+

Description Filip Pizlo 2014-06-14 14:41:59 PDT

...

Comment 1 Filip Pizlo 2014-06-14 14:42:47 PDT

Created attachment 233125 [details]
work in progress

Comment 2 Filip Pizlo 2014-06-16 21:05:18 PDT

Created attachment 233214 [details]
more

Comment 3 Filip Pizlo 2014-06-17 20:21:25 PDT

Created attachment 233279 [details]
rebased

Comment 4 Filip Pizlo 2014-06-17 21:06:11 PDT

Created attachment 233283 [details]
it compiles!

And fails all of the interesting tests.

Comment 5 Filip Pizlo 2014-06-18 13:29:30 PDT

Created attachment 233321 [details]
almost done

Comment 6 Filip Pizlo 2014-06-18 13:43:24 PDT

Created attachment 233322 [details]
ready for review

Comment 7 Mark Hahnenberg 2014-06-18 14:25:29 PDT

Comment on attachment 233322 [details]
ready for review

View in context: https://bugs.webkit.org/attachment.cgi?id=233322&action=review

r=me

> Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:130
> +                    != node->transition()->next)

Weird line break.

Comment 8 Filip Pizlo 2014-06-18 21:35:59 PDT

Landed in http://trac.webkit.org/changeset/170141