Implement TDZ as an op-code and use it in the class implementation.
Created attachment 248323 [details] Adds TDZ in LLint and Baseline JIT
Created attachment 248324 [details] Added a missing @skip
Comment on attachment 248324 [details] Added a missing @skip You should add this opcode to the DFG and FTL as part of this patch. It's not hard to do, and we should stop this bad habit of not adding new things to the optimizing JITs immediately.
Okay, but I literally have no idea what I'm supposed to do in DFG and FTL. I think I need to send this bug to someone in JSC team in that case...
<rdar://problem/20117192>
Created attachment 248449 [details] WIP including DFG
Created attachment 248453 [details] all done
Created attachment 248496 [details] Updated change log
Created attachment 248497 [details] Benchmark results I've ran relevant benchmarks with this patch applied. It doesn't seem to be a regression or progression at r181424.
Created attachment 248498 [details] Benchmark results Oops, the previous benchmark result was wrong. I wasn't turning on ES6_CLASS_SYNTAX. I've re-measured it and I still don't see any progression or regression.
Created attachment 248499 [details] Fixed 32-bit build
Comment on attachment 248499 [details] Fixed 32-bit build View in context: https://bugs.webkit.org/attachment.cgi?id=248499&action=review > Source/JavaScriptCore/ChangeLog:63 > + (JSC::DFG::SpeculativeJIT::compile): Speculative the operand to be not empty. OSR exit if the speculation fails. Speculate* > Source/JavaScriptCore/ChangeLog:70 > + (JSC::FTL::LowerDFGToLLVM::compileCheckNotEmpty): OSR exit with "TDZFailure" if the operand is not empty. if the operand *is* empty.
Comment on attachment 248499 [details] Fixed 32-bit build View in context: https://bugs.webkit.org/attachment.cgi?id=248499&action=review > Source/JavaScriptCore/tests/stress/class-syntax-tdz.js:1 > +//@ skip Why are we skipping? Does this not mean what I think it means?
(In reply to comment #13) > Comment on attachment 248499 [details] > Fixed 32-bit build > > View in context: > https://bugs.webkit.org/attachment.cgi?id=248499&action=review > > > Source/JavaScriptCore/tests/stress/class-syntax-tdz.js:1 > > +//@ skip > > Why are we skipping? Does this not mean what I think it means? ES6 class syntax is disabled by default.
Comment on attachment 248499 [details] Fixed 32-bit build LGTM.
Comment on attachment 248499 [details] Fixed 32-bit build Clearing flags on attachment: 248499 Committed r181466: <http://trac.webkit.org/changeset/181466>
All reviewed patches have been landed. Closing bug.
Comment on attachment 248499 [details] Fixed 32-bit build View in context: https://bugs.webkit.org/attachment.cgi?id=248499&action=review > Source/JavaScriptCore/tests/stress/class-syntax-tdz.js:26 > + throw "Exception not thrown for an unitialized this at iteration " + i; Typo: "unitialized" => "uninitialized"! But doesn't really matter. Nice patch!