Title: [111269] trunk/Source/_javascript_Core
- Revision
- 111269
- Author
- [email protected]
- Date
- 2012-03-19 16:36:59 -0700 (Mon, 19 Mar 2012)
Log Message
Prediction propagation for UInt32ToNumber incorrectly assumes that outs outcome does not
change throughout the fixpoint
https://bugs.webkit.org/show_bug.cgi?id=81583
Reviewed by Michael Saboff.
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (111268 => 111269)
--- trunk/Source/_javascript_Core/ChangeLog 2012-03-19 23:33:53 UTC (rev 111268)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-03-19 23:36:59 UTC (rev 111269)
@@ -1,5 +1,16 @@
2012-03-19 Filip Pizlo <[email protected]>
+ Prediction propagation for UInt32ToNumber incorrectly assumes that outs outcome does not
+ change throughout the fixpoint
+ https://bugs.webkit.org/show_bug.cgi?id=81583
+
+ Reviewed by Michael Saboff.
+
+ * dfg/DFGPredictionPropagationPhase.cpp:
+ (JSC::DFG::PredictionPropagationPhase::propagate):
+
+2012-03-19 Filip Pizlo <[email protected]>
+
GC should not attempt to clear LLInt instruction inline caches for code blocks that are in
the process of being generated
https://bugs.webkit.org/show_bug.cgi?id=81565
Modified: trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp (111268 => 111269)
--- trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp 2012-03-19 23:33:53 UTC (rev 111268)
+++ trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp 2012-03-19 23:36:59 UTC (rev 111269)
@@ -217,9 +217,9 @@
case UInt32ToNumber: {
if (nodeCanSpeculateInteger(node.arithNodeFlags()))
- changed |= setPrediction(PredictInt32);
+ changed |= mergePrediction(PredictInt32);
else
- changed |= setPrediction(PredictNumber);
+ changed |= mergePrediction(PredictNumber);
changed |= m_graph[node.child1()].mergeArithNodeFlags(flags);
break;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
