RESOLVED FIXED168787
SpeculativeJIT::compilePutByValForIntTypedArray should only do the constant-folding optimization when the constant passes the type check 
https://bugs.webkit.org/show_bug.cgi?id=168787
Summary SpeculativeJIT::compilePutByValForIntTypedArray should only do the constant-f...
Filip Pizlo
Reported 2017-02-23 10:58:32 PST
Patch forthcoming.
Attachments
the patch (1.93 KB, patch)
2017-02-23 11:17 PST, Filip Pizlo 		msaboff: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2017-02-23 11:17:21 PST
Created attachment 302543 [details] the patch
Filip Pizlo
Comment 2 2017-02-23 11:17:58 PST
Comment on attachment 302543 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=302543&action=review > Source/JavaScriptCore/ChangeLog:20 > +2017-02-23 Filip Pizlo <fpizlo@apple.com> > + > + Need a short description (OOPS!). > + Need the bug URL (OOPS!). > + > + Reviewed by NOBODY (OOPS!). > + > + * dfg/DFGSpeculativeJIT.cpp: > + (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): > + Ooops, I'll remove this.
Michael Saboff
Comment 3 2017-02-23 11:18:54 PST
Comment on attachment 302543 [details] the patch r=me
Mark Lam
Comment 4 2017-02-23 11:19:57 PST
Comment on attachment 302543 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=302543&action=review r=me > Source/JavaScriptCore/ChangeLog:20 > +2017-02-23 Filip Pizlo <fpizlo@apple.com> > + > + Need a short description (OOPS!). > + Need the bug URL (OOPS!). > + > + Reviewed by NOBODY (OOPS!). > + > + * dfg/DFGSpeculativeJIT.cpp: > + (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): > + redundant.
Filip Pizlo
Comment 5 2017-02-23 11:25:25 PST
(In reply to comment #4) > Comment on attachment 302543 [details] > the patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=302543&action=review > > r=me > > > Source/JavaScriptCore/ChangeLog:20 > > +2017-02-23 Filip Pizlo <fpizlo@apple.com> > > + > > + Need a short description (OOPS!). > > + Need the bug URL (OOPS!). > > + > > + Reviewed by NOBODY (OOPS!). > > + > > + * dfg/DFGSpeculativeJIT.cpp: > > + (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): > > + > > redundant. Fixed locally! Thanks for the reviews.
Filip Pizlo
Comment 6 2017-02-23 11:49:49 PST
Landed in https://trac.webkit.org/changeset/212909
Note You need to log in before you can comment on or make changes to this bug.