Title: [98296] trunk
- Revision
- 98296
- Author
- [email protected]
- Date
- 2011-10-24 16:22:39 -0700 (Mon, 24 Oct 2011)
Log Message
op_new_array_buffer is not inlined correctly
https://bugs.webkit.org/show_bug.cgi?id=70770
Source/_javascript_Core:
Reviewed by Oliver Hunt.
Disabled inlining of op_new_array_buffer, for now.
* dfg/DFGCapabilities.h:
(JSC::DFG::canInlineOpcode):
LayoutTests:
Reviewed by Oliver Hunt.
* fast/js/dfg-inline-new-array-buffer-expected.txt: Added.
* fast/js/dfg-inline-new-array-buffer.html: Added.
* fast/js/script-tests/dfg-inline-new-array-buffer.js: Added.
(foo):
(bar):
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (98295 => 98296)
--- trunk/LayoutTests/ChangeLog 2011-10-24 23:03:14 UTC (rev 98295)
+++ trunk/LayoutTests/ChangeLog 2011-10-24 23:22:39 UTC (rev 98296)
@@ -1,3 +1,16 @@
+2011-10-24 Filip Pizlo <[email protected]>
+
+ op_new_array_buffer is not inlined correctly
+ https://bugs.webkit.org/show_bug.cgi?id=70770
+
+ Reviewed by Oliver Hunt.
+
+ * fast/js/dfg-inline-new-array-buffer-expected.txt: Added.
+ * fast/js/dfg-inline-new-array-buffer.html: Added.
+ * fast/js/script-tests/dfg-inline-new-array-buffer.js: Added.
+ (foo):
+ (bar):
+
2011-10-24 Tim Horton <[email protected]>
feColorMatrix doesn't use the correct default "matrix" type when no type attribute is specified
Added: trunk/LayoutTests/fast/js/dfg-inline-new-array-buffer-expected.txt (0 => 98296)
--- trunk/LayoutTests/fast/js/dfg-inline-new-array-buffer-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-inline-new-array-buffer-expected.txt 2011-10-24 23:22:39 UTC (rev 98296)
@@ -0,0 +1,49 @@
+This tests that inlining correctly handles constant buffers.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS bar()[0] is 1
+PASS bar()[1] is 2
+PASS bar()[2] is 3
+PASS bar()[3] is 4
+PASS bar()[0] is 1
+PASS bar()[1] is 2
+PASS bar()[2] is 3
+PASS bar()[3] is 4
+PASS bar()[0] is 1
+PASS bar()[1] is 2
+PASS bar()[2] is 3
+PASS bar()[3] is 4
+PASS bar()[0] is 1
+PASS bar()[1] is 2
+PASS bar()[2] is 3
+PASS bar()[3] is 4
+PASS bar()[0] is 1
+PASS bar()[1] is 2
+PASS bar()[2] is 3
+PASS bar()[3] is 4
+PASS bar()[0] is 1
+PASS bar()[1] is 2
+PASS bar()[2] is 3
+PASS bar()[3] is 4
+PASS bar()[0] is 1
+PASS bar()[1] is 2
+PASS bar()[2] is 3
+PASS bar()[3] is 4
+PASS bar()[0] is 1
+PASS bar()[1] is 2
+PASS bar()[2] is 3
+PASS bar()[3] is 4
+PASS bar()[0] is 1
+PASS bar()[1] is 2
+PASS bar()[2] is 3
+PASS bar()[3] is 4
+PASS bar()[0] is 1
+PASS bar()[1] is 2
+PASS bar()[2] is 3
+PASS bar()[3] is 4
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/js/dfg-inline-new-array-buffer.html (0 => 98296)
--- trunk/LayoutTests/fast/js/dfg-inline-new-array-buffer.html (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-inline-new-array-buffer.html 2011-10-24 23:22:39 UTC (rev 98296)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/fast/js/script-tests/dfg-inline-new-array-buffer.js (0 => 98296)
--- trunk/LayoutTests/fast/js/script-tests/dfg-inline-new-array-buffer.js (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/dfg-inline-new-array-buffer.js 2011-10-24 23:22:39 UTC (rev 98296)
@@ -0,0 +1,24 @@
+description(
+"This tests that inlining correctly handles constant buffers."
+);
+
+function foo() {
+ return [1, 2, 3, 4];
+}
+
+function bar() {
+ return foo();
+}
+
+for (var i = 0; i < 1000; ++i) {
+ bar();
+}
+
+for (var i = 0; i < 10; ++i) {
+ shouldBe("bar()[0]", "1")
+ shouldBe("bar()[1]", "2")
+ shouldBe("bar()[2]", "3")
+ shouldBe("bar()[3]", "4")
+}
+
+var successfullyParsed = true;
Modified: trunk/Source/_javascript_Core/ChangeLog (98295 => 98296)
--- trunk/Source/_javascript_Core/ChangeLog 2011-10-24 23:03:14 UTC (rev 98295)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-10-24 23:22:39 UTC (rev 98296)
@@ -1,3 +1,15 @@
+2011-10-24 Filip Pizlo <[email protected]>
+
+ op_new_array_buffer is not inlined correctly
+ https://bugs.webkit.org/show_bug.cgi?id=70770
+
+ Reviewed by Oliver Hunt.
+
+ Disabled inlining of op_new_array_buffer, for now.
+
+ * dfg/DFGCapabilities.h:
+ (JSC::DFG::canInlineOpcode):
+
2011-10-24 Yuqiang Xian <[email protected]>
Add boolean speculations to DFG JIT 32_64
Modified: trunk/Source/_javascript_Core/dfg/DFGCapabilities.h (98295 => 98296)
--- trunk/Source/_javascript_Core/dfg/DFGCapabilities.h 2011-10-24 23:03:14 UTC (rev 98295)
+++ trunk/Source/_javascript_Core/dfg/DFGCapabilities.h 2011-10-24 23:22:39 UTC (rev 98296)
@@ -181,6 +181,10 @@
case op_resolve_base:
case op_resolve_global:
+ // Constant buffers aren't copied correctly. This is easy to fix, but for
+ // now we just disable inlining for functions that use them.
+ case op_new_array_buffer:
+
// Inlining doesn't correctly remap regular _expression_ operands.
case op_new_regexp:
return false;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
