Title: [260377] trunk/Source/_javascript_Core
Revision
260377
Author
keith_mil...@apple.com
Date
2020-04-20 11:06:26 -0700 (Mon, 20 Apr 2020)

Log Message

Fix CheckIsConstant for non-constant values and checking for empty
https://bugs.webkit.org/show_bug.cgi?id=210752

Reviewed by Saam Barati.

We need to make sure that we only have one speculated type if our value
is empty.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (260376 => 260377)


--- trunk/Source/_javascript_Core/ChangeLog	2020-04-20 18:04:19 UTC (rev 260376)
+++ trunk/Source/_javascript_Core/ChangeLog	2020-04-20 18:06:26 UTC (rev 260377)
@@ -1,3 +1,16 @@
+2020-04-20  Keith Miller  <keith_mil...@apple.com>
+
+        Fix CheckIsConstant for non-constant values and checking for empty
+        https://bugs.webkit.org/show_bug.cgi?id=210752
+
+        Reviewed by Saam Barati.
+
+        We need to make sure that we only have one speculated type if our value
+        is empty.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
 2020-04-20  Darin Adler  <da...@apple.com>
 
         Use #import instead of #include in Objective-C and don't use #pragma once

Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (260376 => 260377)


--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h	2020-04-20 18:04:19 UTC (rev 260376)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h	2020-04-20 18:06:26 UTC (rev 260377)
@@ -3816,10 +3816,9 @@
     }
     
     case CheckIsConstant: {
-        JSValue value = forNode(node->child1()).value();
-        if (value == node->constant()->value()) {
+        AbstractValue& value = forNode(node->child1());
+        if (value.value() == node->constant()->value() && (value.value() || value.m_type == SpecEmpty)) {
             m_state.setShouldTryConstantFolding(true);
-            ASSERT(value || forNode(node->child1()).m_type == SpecEmpty);
             break;
         }
         filterByValue(node->child1(), *node->constant());
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to