Title: [94914] trunk/Source/_javascript_Core
Revision 94914
Author fpi...@apple.com
Date 2011-09-10 14:23:45 -0700 (Sat, 10 Sep 2011)
Log Message
DFG JIT completely undoes speculative compilation even in the case of
a partial static speculation failure
Title: [94923] trunk/Tools
Revision 94923
Author fpi...@apple.com
Date 2011-09-11 00:13:19 -0700 (Sun, 11 Sep 2011)
Log Message
Added my IRC nick to the committers file.
* Scripts/webkitpy/common/config/committers.py:
Modified Paths
trunk/Tools/ChangeLog
Title: [95060] trunk/Source/_javascript_Core
Revision 95060
Author fpi...@apple.com
Date 2011-09-13 17:37:01 -0700 (Tue, 13 Sep 2011)
Log Message
SpeculativeJIT::shouldSpeculateInteger(NodeIndex, NodeIndex) should
return false if either node can be double
Title: [95116] trunk/Source/_javascript_Core
Revision 95116
Author fpi...@apple.com
Date 2011-09-14 13:48:43 -0700 (Wed, 14 Sep 2011)
Log Message
Unreviewed build fix. Turn off tiered compilation.
* wtf/Platform.h:
Modified Paths
trunk/Source/_javascript_Core/ChangeLog
Title: [95127] trunk/Source/_javascript_Core
Revision 95127
Author fpi...@apple.com
Date 2011-09-14 15:04:50 -0700 (Wed, 14 Sep 2011)
Log Message
DFG should not speculate that the child of LogicalNot is a boolean if
predictions tell us otherwise
Title: [95136] trunk/Source/_javascript_Core
Revision 95136
Author fpi...@apple.com
Date 2011-09-14 16:06:04 -0700 (Wed, 14 Sep 2011)
Log Message
DFG JIT should not speculate integer if the value is always going to be
used as a double anyway
https://bugs.webkit.org/show_bug.cgi?id=68127
Title: [95139] trunk/Source/_javascript_Core
Revision 95139
Author fpi...@apple.com
Date 2011-09-14 16:55:44 -0700 (Wed, 14 Sep 2011)
Log Message
Unreviewed build fix for Interpreter.
* interpreter/Interpreter.cpp:
(JSC::Interpreter::privateExecute):
Modified Paths
Title: [95147] trunk/Source/_javascript_Core
Revision 95147
Author fpi...@apple.com
Date 2011-09-14 18:24:39 -0700 (Wed, 14 Sep 2011)
Log Message
DFG JIT always speculates that ValueAdd is a numeric addition
https://bugs.webkit.org/show_bug.cgi?id=67956
Reviewed by Geoffrey Garen.
*
Title: [95170] trunk/Source/_javascript_Core
Revision 95170
Author fpi...@apple.com
Date 2011-09-14 22:44:07 -0700 (Wed, 14 Sep 2011)
Log Message
DFG JIT does not leverage integer speculations on branches
https://bugs.webkit.org/show_bug.cgi?id=68140
Reviewed by Oliver Hunt.
*
Title: [95172] trunk/Source/_javascript_Core
Revision 95172
Author fpi...@apple.com
Date 2011-09-14 22:49:19 -0700 (Wed, 14 Sep 2011)
Log Message
DFG does not speculate aggressively enough on comparisons
https://bugs.webkit.org/show_bug.cgi?id=68138
Reviewed by Oliver Hunt.
Title: [95206] trunk/Source/_javascript_Core
Revision 95206
Author fpi...@apple.com
Date 2011-09-15 11:54:17 -0700 (Thu, 15 Sep 2011)
Log Message
Tiered compilation should be enabled by default on platforms
that support the DFG JIT
https://bugs.webkit.org/show_bug.cgi?id=68136
Reviewed
Title: [95219] trunk/Source/_javascript_Core
Revision 95219
Author fpi...@apple.com
Date 2011-09-15 12:56:21 -0700 (Thu, 15 Sep 2011)
Log Message
Value profiles collect no information for global variables
https://bugs.webkit.org/show_bug.cgi?id=68143
Reviewed by Geoffrey Garen.
Title: [95221] trunk/Source/_javascript_Core
Revision 95221
Author fpi...@apple.com
Date 2011-09-15 13:05:01 -0700 (Thu, 15 Sep 2011)
Log Message
Unreviewed build fix for assertion on existence of alternative
CodeBlock.
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::predictArgumentTypes):
Title: [95225] trunk/Source/_javascript_Core
Revision 95225
Author fpi...@apple.com
Date 2011-09-15 14:00:40 -0700 (Thu, 15 Sep 2011)
Log Message
Unreviewed build fix for platforms that expect a linkable symbol
for primitive static const's.
* bytecode/CodeBlock.h:
* jit/JIT.cpp:
Title: [95233] trunk/Source/_javascript_Core
Revision 95233
Author fpi...@apple.com
Date 2011-09-15 14:53:48 -0700 (Thu, 15 Sep 2011)
Log Message
DFG speculative JIT sometimes asserts that a value is not a number
even when it doesn't know anything about the number
Title: [95308] trunk/Source/_javascript_Core
Revision 95308
Author fpi...@apple.com
Date 2011-09-16 11:43:25 -0700 (Fri, 16 Sep 2011)
Log Message
REGRESSION: Reproducible crash below SlotVisitor::harvestWeakReferences
using Domino's online ordering
Title: [95313] trunk/Source/_javascript_Core
Revision 95313
Author fpi...@apple.com
Date 2011-09-16 13:05:29 -0700 (Fri, 16 Sep 2011)
Log Message
Unreviewed build fix for non-DFG builds.
* runtime/Executable.h:
(JSC::NativeExecutable::finishCreation):
Modified Paths
Title: [95316] trunk/Source/_javascript_Core
Revision 95316
Author fpi...@apple.com
Date 2011-09-16 13:18:46 -0700 (Fri, 16 Sep 2011)
Log Message
Unreviewed build fix for Windows.
* _javascript_Core.vcproj/_javascript_Core/_javascript_Core.vcproj:
Modified Paths
Title: [95321] trunk/Source/_javascript_Core
Revision 95321
Author fpi...@apple.com
Date 2011-09-16 13:42:19 -0700 (Fri, 16 Sep 2011)
Log Message
Unreviewed Windows build fix after 95318.
* _javascript_Core.vcproj/_javascript_Core/_javascript_Core.def:
Modified Paths
Title: [95388] trunk/Source/_javascript_Core
Revision 95388
Author fpi...@apple.com
Date 2011-09-17 16:33:01 -0700 (Sat, 17 Sep 2011)
Log Message
method_check should repatch itself if it finds that the new structure(s)
are the result of transitions from the old structure(s)
Title: [95523] trunk/Source/_javascript_Core
Revision 95523
Author fpi...@apple.com
Date 2011-09-20 02:41:16 -0700 (Tue, 20 Sep 2011)
Log Message
DFG JIT does not speculate aggressively enough on GetById
https://bugs.webkit.org/show_bug.cgi?id=68320
Reviewed by Oliver Hunt.
Title: [95594] trunk/Source/_javascript_Core
Revision 95594
Author fpi...@apple.com
Date 2011-09-20 19:22:52 -0700 (Tue, 20 Sep 2011)
Log Message
DFG JIT always speculates integer on modulo
https://bugs.webkit.org/show_bug.cgi?id=68485
Reviewed by Oliver Hunt.
Added support for
Title: [95683] trunk/Source/_javascript_Core
Revision 95683
Author fpi...@apple.com
Date 2011-09-21 16:46:09 -0700 (Wed, 21 Sep 2011)
Log Message
DFG JIT should be able to compile op_throw
https://bugs.webkit.org/show_bug.cgi?id=68571
Reviewed by Geoffrey Garen.
This compiles
Title: [95754] trunk/Source/_javascript_Core
Revision 95754
Author fpi...@apple.com
Date 2011-09-22 15:02:24 -0700 (Thu, 22 Sep 2011)
Log Message
DFG JIT should support integer division
https://bugs.webkit.org/show_bug.cgi?id=68597
Reviewed by Darin Adler.
This adds support for
Title: [95772] trunk/Source/_javascript_Core
Revision 95772
Author fpi...@apple.com
Date 2011-09-22 19:16:00 -0700 (Thu, 22 Sep 2011)
Log Message
Another PPC build fix.
* runtime/Executable.cpp:
* runtime/Executable.h:
Modified Paths
trunk/Source/_javascript_Core/ChangeLog
Title: [95779] trunk/Source/_javascript_Core
Revision 95779
Author fpi...@apple.com
Date 2011-09-22 20:27:40 -0700 (Thu, 22 Sep 2011)
Log Message
PPC build fix, part 3.
* runtime/Executable.cpp:
(JSC::FunctionExecutable::compileForConstructInternal):
Modified Paths
Title: [95786] trunk/Source/_javascript_Core
Revision 95786
Author fpi...@apple.com
Date 2011-09-22 23:59:38 -0700 (Thu, 22 Sep 2011)
Log Message
GetScopedVar should have value profiling
https://bugs.webkit.org/show_bug.cgi?id=68676
Reviewed by Oliver Hunt.
Added GetScopedVar value
Title: [95887] trunk/Source/_javascript_Core
Revision 95887
Author fpi...@apple.com
Date 2011-09-23 16:28:07 -0700 (Fri, 23 Sep 2011)
Log Message
Resolve opcodes should have value profiling.
https://bugs.webkit.org/show_bug.cgi?id=68723
Reviewed by Oliver Hunt.
This adds value
Title: [95925] trunk/Source/_javascript_Core
Revision 95925
Author fpi...@apple.com
Date 2011-09-25 16:40:51 -0700 (Sun, 25 Sep 2011)
Log Message
DFG tracking of the value in cachedResultRegister does not handle
op_mov correctly
https://bugs.webkit.org/show_bug.cgi?id=68781
Reviewed by
Title: [96184] trunk/Source/_javascript_Core
Revision 96184
Author fpi...@apple.com
Date 2011-09-27 20:39:36 -0700 (Tue, 27 Sep 2011)
Log Message
DFG JIT should speculate more aggressively on reads of array.length
https://bugs.webkit.org/show_bug.cgi?id=68932
Reviewed by Oliver Hunt.
Title: [96189] trunk/Source/_javascript_Core
Revision 96189
Author fpi...@apple.com
Date 2011-09-27 22:33:21 -0700 (Tue, 27 Sep 2011)
Log Message
DFG JIT cannot compile op_new_object, op_new_array,
op_new_array_buffer, or op_new_regexp
https://bugs.webkit.org/show_bug.cgi?id=68580
Title: [96280] trunk/Source/_javascript_Core
Revision 96280
Author fpi...@apple.com
Date 2011-09-28 17:47:07 -0700 (Wed, 28 Sep 2011)
Log Message
DFG JIT falls back on numerical comparisons when it does not
recognize a prediction
https://bugs.webkit.org/show_bug.cgi?id=68977
Reviewed by
Title: [96306] trunk
Revision 96306
Author fpi...@apple.com
Date 2011-09-29 00:12:10 -0700 (Thu, 29 Sep 2011)
Log Message
DFG checkArgumentTypes fails to check boolean predictions
https://bugs.webkit.org/show_bug.cgi?id=69059
Reviewed by Gavin Barraclough.
Source/_javascript_Core:
*
Title: [96354] trunk/Source/_javascript_Core
Revision 96354
Author fpi...@apple.com
Date 2011-09-29 13:45:52 -0700 (Thu, 29 Sep 2011)
Log Message
Structure transitions involving many ( 64) properties sometimes cause structure corruption
https://bugs.webkit.org/show_bug.cgi?id=69102
Title: [96429] trunk/Source/_javascript_Core
Revision 96429
Author fpi...@apple.com
Date 2011-09-30 14:44:20 -0700 (Fri, 30 Sep 2011)
Log Message
DFG 32-bit support for op_call and op_construct causes
run-_javascript_core-tests to fail
https://bugs.webkit.org/show_bug.cgi?id=69171
Title: [96443] trunk/Source/_javascript_Core
Revision 96443
Author fpi...@apple.com
Date 2011-09-30 17:58:15 -0700 (Fri, 30 Sep 2011)
Log Message
DFG does not speculate aggressively enough on put_by_id
https://bugs.webkit.org/show_bug.cgi?id=69114
Reviewed by Oliver Hunt.
This adds new
Title: [96463] trunk/Source/_javascript_Core
Revision 96463
Author fpi...@apple.com
Date 2011-10-01 15:03:22 -0700 (Sat, 01 Oct 2011)
Log Message
All of JSC's heuristics should be in one place for easier tuning
https://bugs.webkit.org/show_bug.cgi?id=69201
Reviewed by Oliver Hunt.
Title: [96464] trunk/Tools
Revision 96464
Author fpi...@apple.com
Date 2011-10-01 15:08:07 -0700 (Sat, 01 Oct 2011)
Log Message
Added myself to reviewers, because I'm now a reviewer.
* Scripts/webkitpy/common/config/committers.py:
Modified Paths
trunk/Tools/ChangeLog
Title: [96482] trunk/Source/_javascript_Core
Revision 96482
Author fpi...@apple.com
Date 2011-10-02 19:13:11 -0700 (Sun, 02 Oct 2011)
Log Message
DFG misses some obvious opportunities for common subexpression elimination
https://bugs.webkit.org/show_bug.cgi?id=69233
Reviewed by Oliver
Title: [96562] trunk/Source/_javascript_Core
Revision 96562
Author fpi...@apple.com
Date 2011-10-03 18:05:38 -0700 (Mon, 03 Oct 2011)
Log Message
DFG backends don't have access to per-node predictions from the propagator
https://bugs.webkit.org/show_bug.cgi?id=69291
Reviewed by Oliver
Title: [96564] trunk/Source/_javascript_Core
Revision 96564
Author fpi...@apple.com
Date 2011-10-03 18:37:19 -0700 (Mon, 03 Oct 2011)
Log Message
JSC ASSERT Opening the Web Inspector
https://bugs.webkit.org/show_bug.cgi?id=69293
Reviewed by Oliver Hunt.
If a polymorphic access
Title: [96567] trunk/Source/_javascript_Core
Revision 96567
Author fpi...@apple.com
Date 2011-10-03 19:55:54 -0700 (Mon, 03 Oct 2011)
Log Message
DFG should inline Array.push and Array.pop
https://bugs.webkit.org/show_bug.cgi?id=69314
Reviewed by Oliver Hunt.
1% speed-up in V8
Title: [96569] trunk/Source/_javascript_Core
Revision 96569
Author fpi...@apple.com
Date 2011-10-03 20:20:05 -0700 (Mon, 03 Oct 2011)
Log Message
DFG should inline Array.push and Array.pop
https://bugs.webkit.org/show_bug.cgi?id=69314
Reviewed by Geoff Garen.
Fix 32-bit.
*
Title: [96661] trunk/Source/_javascript_Core
Revision 96661
Author fpi...@apple.com
Date 2011-10-04 16:02:25 -0700 (Tue, 04 Oct 2011)
Log Message
JITCodeGenerator should no longer have code that tries too hard
to be both speculative and non-speculative
Title: [96750] trunk/Source/_javascript_Core
Revision 96750
Author fpi...@apple.com
Date 2011-10-05 14:36:23 -0700 (Wed, 05 Oct 2011)
Log Message
DFG should be capable of a broader range of speculations on branch and not
https://bugs.webkit.org/show_bug.cgi?id=69322
Reviewed by Oliver
Title: [96762] trunk/Source/_javascript_Core
Revision 96762
Author fpi...@apple.com
Date 2011-10-05 15:51:31 -0700 (Wed, 05 Oct 2011)
Log Message
Assertion hit in JSC::DFG::SpeculativeJIT::compile on SL bots
https://bugs.webkit.org/show_bug.cgi?id=69346
Reviewed by Oliver Hunt.
Title: [96794] trunk/Source/_javascript_Core
Revision 96794
Author fpi...@apple.com
Date 2011-10-06 02:08:25 -0700 (Thu, 06 Oct 2011)
Log Message
SpeculativeJIT::isKnownString() is wrong
https://bugs.webkit.org/show_bug.cgi?id=69501
Reviewed by Oliver Hunt.
Removed the wrong
Title: [96860] trunk/Source/_javascript_Core
Revision 96860
Author fpi...@apple.com
Date 2011-10-06 14:43:00 -0700 (Thu, 06 Oct 2011)
Log Message
DFG implementation of UInt32ToNumber is missing a break statement
https://bugs.webkit.org/show_bug.cgi?id=69552
Reviewed by Oliver Hunt.
*
Title: [96883] trunk/Source/_javascript_Core
Revision 96883
Author fpi...@apple.com
Date 2011-10-06 17:47:21 -0700 (Thu, 06 Oct 2011)
Log Message
Structure does not reset m_previous when pinning the property map
https://bugs.webkit.org/show_bug.cgi?id=69583
Reviewed by Gavin
Title: [96894] trunk/Source/_javascript_Core
Revision 96894
Author fpi...@apple.com
Date 2011-10-06 19:48:47 -0700 (Thu, 06 Oct 2011)
Log Message
DFG should not always speculate that ConvertThis is operating on an object
https://bugs.webkit.org/show_bug.cgi?id=69570
Reviewed by Oliver
Title: [96980] trunk/Source/_javascript_Core
Revision 96980
Author fpi...@apple.com
Date 2011-10-07 13:52:56 -0700 (Fri, 07 Oct 2011)
Log Message
DFG ConvertThis speculation logic is wrong
https://bugs.webkit.org/show_bug.cgi?id=69663
Reviewed by Oliver Hunt.
* dfg/DFGPropagator.cpp:
Title: [97005] trunk/Source/_javascript_Core
Revision 97005
Author fpi...@apple.com
Date 2011-10-08 01:15:53 -0700 (Sat, 08 Oct 2011)
Log Message
DFG JIT - only Array predictions can result in unboxed cells in register file
https://bugs.webkit.org/show_bug.cgi?id=69695
Patch by Yuqiang
Title: [97030] trunk/Source/_javascript_Core
Revision 97030
Author fpi...@apple.com
Date 2011-10-09 13:07:36 -0700 (Sun, 09 Oct 2011)
Log Message
DFG should not always speculate that a ByVal access has an integer index
https://bugs.webkit.org/show_bug.cgi?id=69716
Reviewed by Oliver
Title: [97033] trunk/Source/_javascript_Core
Revision 97033
Author fpi...@apple.com
Date 2011-10-09 15:40:01 -0700 (Sun, 09 Oct 2011)
Log Message
Remove unused callOperation code of DFG JIT on X86
https://bugs.webkit.org/show_bug.cgi?id=69722
Patch by Yuqiang Xian yuqiang.x...@intel.com
Title: [97099] trunk
Revision 97099
Author fpi...@apple.com
Date 2011-10-10 15:41:01 -0700 (Mon, 10 Oct 2011)
Log Message
REGRESSIoN (r95399): Web process hangs when opening documents on Google Docs
https://bugs.webkit.org/show_bug.cgi?id=69412
Reviewed by Oliver Hunt.
Title: [97118] trunk/Source/_javascript_Core
Revision 97118
Author fpi...@apple.com
Date 2011-10-10 18:14:13 -0700 (Mon, 10 Oct 2011)
Log Message
DFG JSVALUE64 spill/fill code should not box integers and doubles
https://bugs.webkit.org/show_bug.cgi?id=69782
Reviewed by Oliver Hunt.
Title: [97187] trunk/Tools
Revision 97187
Author fpi...@apple.com
Date 2011-10-11 14:56:09 -0700 (Tue, 11 Oct 2011)
Log Message
Some API tests are timing out in Release
https://bugs.webkit.org/show_bug.cgi?id=69787
Reviewed by Mark Rowe.
NDEBUG must be set in release builds.
Title: [97197] trunk/Source/_javascript_Core
Revision 97197
Author fpi...@apple.com
Date 2011-10-11 16:50:26 -0700 (Tue, 11 Oct 2011)
Log Message
DFG virtual register allocator should be more aggressive in
reusing temporary slots
https://bugs.webkit.org/show_bug.cgi?id=69868
Reviewed by
Title: [97240] trunk/Source/_javascript_Core
Revision 97240
Author fpi...@apple.com
Date 2011-10-12 01:01:11 -0700 (Wed, 12 Oct 2011)
Log Message
Layout tests crashing in DFG JIT code
https://bugs.webkit.org/show_bug.cgi?id=69897
Reviewed by Gavin Barraclough.
Abstract value filtration
Title: [97294] trunk/Source/_javascript_Core
Revision 97294
Author fpi...@apple.com
Date 2011-10-12 13:28:49 -0700 (Wed, 12 Oct 2011)
Log Message
ValueProfile::computeUpdatedPrediction doesn't merge statistics correctly
https://bugs.webkit.org/show_bug.cgi?id=69906
Reviewed by Gavin
Title: [97334] trunk/Source/_javascript_Core
Revision 97334
Author fpi...@apple.com
Date 2011-10-12 19:20:42 -0700 (Wed, 12 Oct 2011)
Log Message
DFG CFA does not filter structures aggressively enough.
https://bugs.webkit.org/show_bug.cgi?id=69989
Reviewed by Oliver Hunt.
*
Title: [97342] trunk/Source/_javascript_Core
Revision 97342
Author fpi...@apple.com
Date 2011-10-12 22:01:36 -0700 (Wed, 12 Oct 2011)
Log Message
If an Arguments object is being used to copy the arguments, then
make this explicit
https://bugs.webkit.org/show_bug.cgi?id=69995
Reviewed by
Title: [97432] trunk/Source/_javascript_Core
Revision 97432
Author fpi...@apple.com
Date 2011-10-13 18:01:45 -0700 (Thu, 13 Oct 2011)
Log Message
Rubber stamped Stephanie Lewis.
DFG_ENABLE() macro was always returning false.
* dfg/DFGNode.h:
Modified Paths
Title: [97446] trunk/Source/_javascript_Core
Revision 97446
Author fpi...@apple.com
Date 2011-10-14 00:07:46 -0700 (Fri, 14 Oct 2011)
Log Message
Speculation failures in ValueToInt32 are causing a 2x slow-down
in Kraken/stanford-crypto-pbkdf2
https://bugs.webkit.org/show_bug.cgi?id=70089
Title: [97512] trunk/Source/_javascript_Core
Revision 97512
Author fpi...@apple.com
Date 2011-10-14 15:01:10 -0700 (Fri, 14 Oct 2011)
Log Message
Reflective Arguments retrieval should be hardened for the
possibility of inlining
https://bugs.webkit.org/show_bug.cgi?id=70068
Reviewed by
Title: [97564] trunk/Source/_javascript_Core
Revision 97564
Author fpi...@apple.com
Date 2011-10-15 14:44:50 -0700 (Sat, 15 Oct 2011)
Log Message
FunctionExecutable should expose the ability to create unattached FunctionCodeBlocks
https://bugs.webkit.org/show_bug.cgi?id=70157
Reviewed
Title: [97940] trunk/Source/_javascript_Core
Revision 97940
Author fpi...@apple.com
Date 2011-10-19 23:33:33 -0700 (Wed, 19 Oct 2011)
Log Message
Optimization triggers in the old JIT may sometimes fire repeatedly even
though there is no optimization to be done
Title: [97942] trunk/Source/_javascript_Core
Revision 97942
Author fpi...@apple.com
Date 2011-10-19 23:39:33 -0700 (Wed, 19 Oct 2011)
Log Message
DFG ConvertThis emits slow code when the source node is known to be,
but not predicted to be, a final object
Title: [97951] trunk/Source/_javascript_Core
Revision 97951
Author fpi...@apple.com
Date 2011-10-20 02:10:06 -0700 (Thu, 20 Oct 2011)
Log Message
https://bugs.webkit.org/show_bug.cgi?id=70482
DFG-related stubs in the old JIT should not be built if the DFG is disabled
Reviewed by Zoltan
Title: [98065] trunk/Source/_javascript_Core
Revision 98065
Author fpi...@apple.com
Date 2011-10-20 22:14:06 -0700 (Thu, 20 Oct 2011)
Log Message
DFG call optimization handling will fail if the call had been unlinked due
to the callee being optimized
Title: [98082] trunk/Source/_javascript_Core
Revision 98082
Author fpi...@apple.com
Date 2011-10-21 01:19:03 -0700 (Fri, 21 Oct 2011)
Log Message
DFG should not try to predict argument types by looking at the values of
argument registers at the time of compilation
Title: [98167] trunk/Tools
Revision 98167
Author fpi...@apple.com
Date 2011-10-21 16:20:38 -0700 (Fri, 21 Oct 2011)
Log Message
Bencher script doesn't measure GC times accurately
https://bugs.webkit.org/show_bug.cgi?id=70588
Reviewed by Geoff Garen.
Added two new options which
Title: [98188] trunk
Revision 98188
Author fpi...@apple.com
Date 2011-10-21 20:58:55 -0700 (Fri, 21 Oct 2011)
Log Message
DFG inlining sometimes fails to reset constant references
https://bugs.webkit.org/show_bug.cgi?id=70668
Source/_javascript_Core:
Reviewed by Anders Carlsson.
Title: [98296] trunk
Revision 98296
Author fpi...@apple.com
Date 2011-10-24 16:22:39 -0700 (Mon, 24 Oct 2011)
Log Message
op_new_array_buffer is not inlined correctly
https://bugs.webkit.org/show_bug.cgi?id=70770
Source/_javascript_Core:
Reviewed by Oliver Hunt.
Disabled
Title: [98299] trunk
Revision 98299
Author fpi...@apple.com
Date 2011-10-24 17:00:14 -0700 (Mon, 24 Oct 2011)
Log Message
Object-or-other branch speculation may corrupt the state for OSR if the child of the
branch is an integer
https://bugs.webkit.org/show_bug.cgi?id=70777
Reviewed by
Title: [98398] trunk/Source/_javascript_Core
Revision 98398
Author fpi...@apple.com
Date 2011-10-25 14:56:31 -0700 (Tue, 25 Oct 2011)
Log Message
Tiered compilation may introduce dangling pointers in constant buffers
https://bugs.webkit.org/show_bug.cgi?id=70854
Reviewed by Oliver Hunt.
Title: [98647] trunk/Source/_javascript_Core
Revision 98647
Author fpi...@apple.com
Date 2011-10-27 15:19:14 -0700 (Thu, 27 Oct 2011)
Log Message
Crash in JSC::Structure::materializePropertyMap when viewing Garden-O-Matic
https://bugs.webkit.org/show_bug.cgi?id=71045
Reviewed by Geoff
Title: [98658] trunk
Revision 98658
Author fpi...@apple.com
Date 2011-10-27 16:35:43 -0700 (Thu, 27 Oct 2011)
Log Message
If the bytecode generator emits code after the return in the first basic block,
DFG's inliner crashes
https://bugs.webkit.org/show_bug.cgi?id=71071
Title: [100820] trunk/Source/_javascript_Core
Revision 100820
Author fpi...@apple.com
Date 2011-11-18 15:29:20 -0800 (Fri, 18 Nov 2011)
Log Message
Crash in JSC::DFG::OSRExitCompiler::compileExit(JSC::DFG::OSRExit const, JSC::DFG::SpeculationRecovery*)
Title: [100878] trunk/Source/_javascript_Core
Revision 100878
Author fpi...@apple.com
Date 2011-11-20 19:32:02 -0800 (Sun, 20 Nov 2011)
Log Message
DFG 32_64 should directly store double virtual registers on SetLocal
https://bugs.webkit.org/show_bug.cgi?id=72845
Reviewed by Oliver Hunt.
Title: [100879] trunk
Revision 100879
Author fpi...@apple.com
Date 2011-11-20 20:35:38 -0800 (Sun, 20 Nov 2011)
Log Message
Showing the data overlay in OpenStreetMap doesn't work, zooming partially broken
https://bugs.webkit.org/show_bug.cgi?id=71505
Source/_javascript_Core:
Reviewed
Title: [100883] trunk/Source/_javascript_Core
Revision 100883
Author fpi...@apple.com
Date 2011-11-20 21:03:08 -0800 (Sun, 20 Nov 2011)
Log Message
Unreviewed interpreter build fix.
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::finalizeUnconditionally):
* dfg/DFGRepatch.h:
Modified Paths
Title: [100888] trunk/Source/_javascript_Core
Revision 100888
Author fpi...@apple.com
Date 2011-11-21 00:37:44 -0800 (Mon, 21 Nov 2011)
Log Message
Another attempt at a build fix.
* dfg/DFGRepatch.h:
(JSC::DFG::dfgResetGetByID):
(JSC::DFG::dfgResetPutByID):
Modified Paths
Title: [100972] trunk/Source/_javascript_Core
Revision 100972
Author fpi...@apple.com
Date 2011-11-21 18:15:36 -0800 (Mon, 21 Nov 2011)
Log Message
Showing the data overlay in OpenStreetMap doesn't work, zooming partially broken
https://bugs.webkit.org/show_bug.cgi?id=71505
Reviewed by
Title: [100975] trunk
Revision 100975
Author fpi...@apple.com
Date 2011-11-21 19:02:33 -0800 (Mon, 21 Nov 2011)
Log Message
DFG should have richer debug output for CFA and phi processing
https://bugs.webkit.org/show_bug.cgi?id=72922
Reviewed by Gavin Barraclough.
In the default
Title: [101217] trunk/Source/_javascript_Core
Revision 101217
Author fpi...@apple.com
Date 2011-11-27 18:11:58 -0800 (Sun, 27 Nov 2011)
Log Message
DFG should not emit GetMethod node
https://bugs.webkit.org/show_bug.cgi?id=73175
Reviewed by Gavin Barraclough.
Replaces all
Title: [101283] trunk/Source/_javascript_Core
Revision 101283
Author fpi...@apple.com
Date 2011-11-28 14:48:17 -0800 (Mon, 28 Nov 2011)
Log Message
Either remove the GetMethod node from the DFG backend, or find a use for it
https://bugs.webkit.org/show_bug.cgi?id=73178
Reviewed by Gavin
Title: [101291] trunk/Source/_javascript_Core
Revision 101291
Author fpi...@apple.com
Date 2011-11-28 15:07:26 -0800 (Mon, 28 Nov 2011)
Log Message
Don't try to optimize huge code blocks
https://bugs.webkit.org/show_bug.cgi?id=73187
Reviewed by Oliver Hunt.
This unifies the
Title: [101298] trunk/Source/_javascript_Core
Revision 101298
Author fpi...@apple.com
Date 2011-11-28 15:51:51 -0800 (Mon, 28 Nov 2011)
Log Message
GetById should not always speculate cell
https://bugs.webkit.org/show_bug.cgi?id=73181
Reviewed by Gavin Barraclough.
GetById will
Title: [101324] trunk/Source/_javascript_Core
Revision 101324
Author fpi...@apple.com
Date 2011-11-28 20:59:15 -0800 (Mon, 28 Nov 2011)
Log Message
Unreviewed build fixes for ARM.
* assembler/MacroAssemblerARMv7.h:
(JSC::MacroAssemblerARMv7::readCallTarget):
* dfg/DFGSpeculativeJIT.h:
Title: [101332] trunk/Source/_javascript_Core
Revision 101332
Author fpi...@apple.com
Date 2011-11-28 23:44:11 -0800 (Mon, 28 Nov 2011)
Log Message
DFG non-X86 ArithDiv does speculation failure after mutating state,
without a value recovery
https://bugs.webkit.org/show_bug.cgi?id=73286
Title: [101334] trunk/Source/_javascript_Core
Revision 101334
Author fpi...@apple.com
Date 2011-11-28 23:57:23 -0800 (Mon, 28 Nov 2011)
Log Message
DFG debugCall() mechanism only works on X86 and X86-64
https://bugs.webkit.org/show_bug.cgi?id=73282
Reviewed by Oliver Hunt.
*
Title: [101457] trunk/Source/_javascript_Core
Revision 101457
Author fpi...@apple.com
Date 2011-11-30 00:44:12 -0800 (Wed, 30 Nov 2011)
Log Message
Resetting a put_by_id inline cache should preserve the isDirect bit
https://bugs.webkit.org/show_bug.cgi?id=73375
Reviewed by Gavin
Title: [101615] trunk/Source/_javascript_Core
Revision 101615
Author fpi...@apple.com
Date 2011-11-30 23:11:19 -0800 (Wed, 30 Nov 2011)
Log Message
DFG should make it easier to notice node boundaries in disassembly
https://bugs.webkit.org/show_bug.cgi?id=73509
Rubber-stamped by Gavin
Title: [101639] trunk/Source/_javascript_Core
Revision 101639
Author fpi...@apple.com
Date 2011-12-01 01:05:16 -0800 (Thu, 01 Dec 2011)
Log Message
BitVector isInline check could fail
https://bugs.webkit.org/show_bug.cgi?id=70691
Reviewed by Gavin Barraclough.
Switch back to
Title: [101693] trunk/Source/_javascript_Core
Revision 101693
Author fpi...@apple.com
Date 2011-12-01 11:45:29 -0800 (Thu, 01 Dec 2011)
Log Message
ARMv7 only allows for one-shot patching of compact offsets, while the
JIT expects to be able to repatch
Title: [101964] trunk/Source/_javascript_Core
Revision 101964
Author fpi...@apple.com
Date 2011-12-04 13:16:43 -0800 (Sun, 04 Dec 2011)
Log Message
DFG should optimize strict equality
https://bugs.webkit.org/show_bug.cgi?id=73764
Reviewed by Oliver Hunt.
1% speed-up on V8.
*
Title: [102038] trunk/Source/_javascript_Core
Revision 102038
Author fpi...@apple.com
Date 2011-12-05 13:25:18 -0800 (Mon, 05 Dec 2011)
Log Message
Unreviewed, build fixes for ARM.
* assembler/AbstractMacroAssembler.h:
(JSC::AbstractMacroAssembler::unreachableForPlatform):
*
Title: [102042] trunk/Source/_javascript_Core
Revision 102042
Author fpi...@apple.com
Date 2011-12-05 13:45:30 -0800 (Mon, 05 Dec 2011)
Log Message
Old JIT emits 32-bit offsets for put_by_id but sometimes patches them as if they
were compact offsets
Title: [102057] trunk/Source/_javascript_Core
Revision 102057
Author fpi...@apple.com
Date 2011-12-05 15:50:15 -0800 (Mon, 05 Dec 2011)
Log Message
Unreviewed build fix for non-DFG platforms.
* dfg/DFGRepatch.h:
Modified Paths
trunk/Source/_javascript_Core/ChangeLog
1 - 100 of 2695 matches
Mail list logo
