Bug 67956

Summary: DFG JIT always speculates that ValueAdd is a numeric addition
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: barraclough, fpizlo, oliver
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
the patch
ggaren: review+, webkit-ews: commit-queue-
the patch - disable tiering none

Description Filip Pizlo 2011-09-12 15:10:28 PDT
DFG JIT always speculates that ValueAdd is a numerical addition even when there is evidence to the contrary.  This causes all uses of "+" for string concatenation to fall off the speculative path.
Comment 1 Filip Pizlo 2011-09-12 15:45:30 PDT
Created attachment 107095 [details]
the patch
Comment 2 Geoffrey Garen 2011-09-12 15:50:19 PDT
Comment on attachment 107095 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=107095&action=review

r=me

> Source/JavaScriptCore/wtf/Platform.h:968
> -#define ENABLE_TIERED_COMPILATION 0
> +#define ENABLE_TIERED_COMPILATION 1

Oops?
Comment 3 Early Warning System Bot 2011-09-12 16:02:47 PDT
Comment on attachment 107095 [details]
the patch

Attachment 107095 [details] did not pass qt-ews (qt):
Output: http://queues.webkit.org/results/9649142
Comment 4 Filip Pizlo 2011-09-12 16:11:49 PDT
(In reply to comment #2)
> (From update of attachment 107095 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=107095&action=review
> 
> r=me
> 
> > Source/JavaScriptCore/wtf/Platform.h:968
> > -#define ENABLE_TIERED_COMPILATION 0
> > +#define ENABLE_TIERED_COMPILATION 1
> 
> Oops?

Oops indeed!
Comment 5 Filip Pizlo 2011-09-12 16:17:52 PDT
Created attachment 107103 [details]
the patch - disable tiering

Will wait for bots before committing.
Comment 6 Filip Pizlo 2011-09-12 16:54:25 PDT
It's probably best to land this after the OSR patches land.  Leaving it up here until then.
Comment 7 Filip Pizlo 2011-09-14 19:02:44 PDT
Landed in r95147.