Diff
Modified: trunk/LayoutTests/ChangeLog (96305 => 96306)
--- trunk/LayoutTests/ChangeLog 2011-09-29 06:32:20 UTC (rev 96305)
+++ trunk/LayoutTests/ChangeLog 2011-09-29 07:12:10 UTC (rev 96306)
@@ -1,3 +1,15 @@
+2011-09-28 Filip Pizlo <fpi...@apple.com>
+
+ DFG checkArgumentTypes fails to check boolean predictions
+ https://bugs.webkit.org/show_bug.cgi?id=69059
+
+ Reviewed by Gavin Barraclough.
+
+ * fast/js/boolean-argument-prediction-expected.txt: Added.
+ * fast/js/boolean-argument-prediction.html: Added.
+ * fast/js/script-tests/boolean-argument-prediction.js: Added.
+ (predictBooleanArgument):
+
2011-09-28 Shinichiro Hamaji <ham...@chromium.org>
Chromium test_expectations update for isindex-with-no-form.html
Added: trunk/LayoutTests/fast/js/boolean-argument-prediction-expected.txt (0 => 96306)
--- trunk/LayoutTests/fast/js/boolean-argument-prediction-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/js/boolean-argument-prediction-expected.txt 2011-09-29 07:12:10 UTC (rev 96306)
@@ -0,0 +1,25 @@
+This tests that arguments predicted to be boolean are checked.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS predictBooleanArgument(true) is "yes"
+PASS predictBooleanArgument(false) is "no"
+PASS predictBooleanArgument(true) is "yes"
+PASS predictBooleanArgument(false) is "no"
+PASS predictBooleanArgument(0) is "no"
+PASS predictBooleanArgument(1) is "yes"
+PASS predictBooleanArgument(2) is "yes"
+PASS predictBooleanArgument(3) is "yes"
+PASS predictBooleanArgument(4) is "yes"
+PASS predictBooleanArgument(true) is "yes"
+PASS predictBooleanArgument(false) is "no"
+PASS predictBooleanArgument(0) is "no"
+PASS predictBooleanArgument(1) is "yes"
+PASS predictBooleanArgument(2) is "yes"
+PASS predictBooleanArgument(3) is "yes"
+PASS predictBooleanArgument(4) is "yes"
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/js/boolean-argument-prediction.html (0 => 96306)
--- trunk/LayoutTests/fast/js/boolean-argument-prediction.html (rev 0)
+++ trunk/LayoutTests/fast/js/boolean-argument-prediction.html 2011-09-29 07:12:10 UTC (rev 96306)
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href=""
+<script src=""
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/fast/js/script-tests/boolean-argument-prediction.js (0 => 96306)
--- trunk/LayoutTests/fast/js/script-tests/boolean-argument-prediction.js (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/boolean-argument-prediction.js 2011-09-29 07:12:10 UTC (rev 96306)
@@ -0,0 +1,47 @@
+description(
+"This tests that arguments predicted to be boolean are checked."
+);
+
+function predictBooleanArgument(b) {
+ if (b) {
+ return "yes";
+ } else {
+ return "no";
+ }
+}
+
+shouldBe("predictBooleanArgument(true)", "\"yes\"");
+shouldBe("predictBooleanArgument(false)", "\"no\"");
+
+for (var i = 0; i < 1000; ++i) {
+ predictBooleanArgument(true);
+ predictBooleanArgument(false);
+}
+
+shouldBe("predictBooleanArgument(true)", "\"yes\"");
+shouldBe("predictBooleanArgument(false)", "\"no\"");
+
+shouldBe("predictBooleanArgument(0)", "\"no\"");
+shouldBe("predictBooleanArgument(1)", "\"yes\"");
+shouldBe("predictBooleanArgument(2)", "\"yes\"");
+shouldBe("predictBooleanArgument(3)", "\"yes\"");
+shouldBe("predictBooleanArgument(4)", "\"yes\"");
+
+for (var i = 0; i < 1000; ++i) {
+ predictBooleanArgument(0);
+ predictBooleanArgument(1);
+ predictBooleanArgument(2);
+ predictBooleanArgument(3);
+ predictBooleanArgument(4);
+}
+
+shouldBe("predictBooleanArgument(true)", "\"yes\"");
+shouldBe("predictBooleanArgument(false)", "\"no\"");
+
+shouldBe("predictBooleanArgument(0)", "\"no\"");
+shouldBe("predictBooleanArgument(1)", "\"yes\"");
+shouldBe("predictBooleanArgument(2)", "\"yes\"");
+shouldBe("predictBooleanArgument(3)", "\"yes\"");
+shouldBe("predictBooleanArgument(4)", "\"yes\"");
+
+var successfullyParsed = true;
Modified: trunk/Source/_javascript_Core/ChangeLog (96305 => 96306)
--- trunk/Source/_javascript_Core/ChangeLog 2011-09-29 06:32:20 UTC (rev 96305)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-09-29 07:12:10 UTC (rev 96306)
@@ -1,3 +1,15 @@
+2011-09-28 Filip Pizlo <fpi...@apple.com>
+
+ DFG checkArgumentTypes fails to check boolean predictions
+ https://bugs.webkit.org/show_bug.cgi?id=69059
+
+ Reviewed by Gavin Barraclough.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+
2011-09-28 Gavin Barraclough <barraclo...@apple.com>
Build fix pt 2 for r96286.
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (96305 => 96306)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2011-09-29 06:32:20 UTC (rev 96305)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2011-09-29 07:12:10 UTC (rev 96306)
@@ -2285,6 +2285,11 @@
m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
speculationCheck(m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
speculationCheck(m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->jsArrayVPtr)));
+ } else if (isBooleanPrediction(predictedType)) {
+ GPRTemporary temp(this);
+ m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
+ m_jit.xorPtr(TrustedImm32(static_cast<int32_t>(ValueFalse)), temp.gpr());
+ speculationCheck(m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), TrustedImm32(static_cast<int32_t>(~1))));
}
}
}
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (96305 => 96306)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2011-09-29 06:32:20 UTC (rev 96305)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2011-09-29 07:12:10 UTC (rev 96306)
@@ -2221,7 +2221,7 @@
speculationCheck(m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
speculationCheck(m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->jsArrayVPtr)));
- }
+ } // FIXME: need boolean predictions, but we currently don't have that support.
}
}
