Title: [118333] trunk/Source/_javascript_Core
- Revision
- 118333
- Author
- [email protected]
- Date
- 2012-05-24 00:35:05 -0700 (Thu, 24 May 2012)
Log Message
Incorrect merge of r117542 from dfg opt branch in r118323 is leading to fast/js/dfg-arguments-osr-exit.html failing
https://bugs.webkit.org/show_bug.cgi?id=87350
Reviewed by Maciej Stachowiak.
The dfgopt branch introduced the notion of a local variable being killed because it was aliased
to the Arguments object as in cases like:
var a = arguments;
return a.length;
This required changes to OSR exit handling - if the variable is dead but aliased to arguments, then
OSR exit should reify the arguments. But meanwhile, in tip of tree we introduced special handling for
dead variables on OSR exit. When the two were merged in r118323, the structure of the if/else branches
ended up being such that we would treat dead arguments variables as totally dead as opposed to treating
them as variables that need arguments reification.
This fixes the structure of the relevant if/else block so that variables that are dead-but-arguments
end up being treated as reified arguments objects, while variables that are dead but not aliased to
arguments are treated as tip of tree would have treated them (initialize to Undefined).
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compile):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (118332 => 118333)
--- trunk/Source/_javascript_Core/ChangeLog 2012-05-24 07:29:21 UTC (rev 118332)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-05-24 07:35:05 UTC (rev 118333)
@@ -1,3 +1,29 @@
+2012-05-24 Filip Pizlo <[email protected]>
+
+ Incorrect merge of r117542 from dfg opt branch in r118323 is leading to fast/js/dfg-arguments-osr-exit.html failing
+ https://bugs.webkit.org/show_bug.cgi?id=87350
+
+ Reviewed by Maciej Stachowiak.
+
+ The dfgopt branch introduced the notion of a local variable being killed because it was aliased
+ to the Arguments object as in cases like:
+
+ var a = arguments;
+ return a.length;
+
+ This required changes to OSR exit handling - if the variable is dead but aliased to arguments, then
+ OSR exit should reify the arguments. But meanwhile, in tip of tree we introduced special handling for
+ dead variables on OSR exit. When the two were merged in r118323, the structure of the if/else branches
+ ended up being such that we would treat dead arguments variables as totally dead as opposed to treating
+ them as variables that need arguments reification.
+
+ This fixes the structure of the relevant if/else block so that variables that are dead-but-arguments
+ end up being treated as reified arguments objects, while variables that are dead but not aliased to
+ arguments are treated as tip of tree would have treated them (initialize to Undefined).
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+
2012-05-24 Csaba Osztrogonác <[email protected]>
Unreviewed 32 bit buildfix after r118325.
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (118332 => 118333)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2012-05-24 07:29:21 UTC (rev 118332)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2012-05-24 07:35:05 UTC (rev 118333)
@@ -994,12 +994,14 @@
// https://bugs.webkit.org/show_bug.cgi?id=87205
if (m_jit.codeBlock()->localIsCaptured(at(block[0]).codeOrigin.inlineCallFrame, i))
m_variables[i] = ValueSource(ValueInRegisterFile);
- else if (nodeIndex == NoNode || !at(nodeIndex).refCount())
+ else if (nodeIndex == NoNode)
m_variables[i] = ValueSource(SourceIsDead);
+ else if (at(nodeIndex).variableAccessData()->isArgumentsAlias())
+ m_variables[i] = ValueSource(ArgumentsSource);
+ else if (!at(nodeIndex).refCount())
+ m_variables[i] = ValueSource(SourceIsDead);
else if (at(nodeIndex).variableAccessData()->shouldUseDoubleFormat())
m_variables[i] = ValueSource(DoubleInRegisterFile);
- else if (at(nodeIndex).variableAccessData()->isArgumentsAlias())
- m_variables[i] = ValueSource(ArgumentsSource);
else
m_variables[i] = ValueSource::forPrediction(at(nodeIndex).variableAccessData()->prediction());
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
