Title: [204209] trunk/Source/_javascript_Core
- Revision
- 204209
- Author
- [email protected]
- Date
- 2016-08-05 18:05:15 -0700 (Fri, 05 Aug 2016)
Log Message
32-bit JSC test failure: stress/instanceof-late-constant-folding.js
https://bugs.webkit.org/show_bug.cgi?id=160620
Reviewed by Filip Pizlo.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (204208 => 204209)
--- trunk/Source/_javascript_Core/ChangeLog 2016-08-06 00:53:29 UTC (rev 204208)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-08-06 01:05:15 UTC (rev 204209)
@@ -1,3 +1,13 @@
+2016-08-05 Keith Miller <[email protected]>
+
+ 32-bit JSC test failure: stress/instanceof-late-constant-folding.js
+ https://bugs.webkit.org/show_bug.cgi?id=160620
+
+ Reviewed by Filip Pizlo.
+
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+
2016-08-05 Benjamin Poulain <[email protected]>
[JSC] Remove the first LocalCSE
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (204208 => 204209)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2016-08-06 00:53:29 UTC (rev 204208)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2016-08-06 01:05:15 UTC (rev 204209)
@@ -4627,8 +4627,7 @@
Node* hasInstanceValueNode = node->child2().node();
JSFunction* defaultHasInstanceFunction = jsCast<JSFunction*>(node->cellOperand()->value());
- MacroAssembler::Jump notDefaulthasInstanceValue;
- MacroAssembler::Jump hasInstanceValueNotCell;
+ MacroAssembler::JumpList notDefaultHasInstanceValue;
SpeculateCellOperand base(this, node->child1());
JSValueOperand hasInstanceValue(this, node->child2());
GPRTemporary result(this);
@@ -4641,8 +4640,8 @@
// since it relies on OSR information. https://bugs.webkit.org/show_bug.cgi?id=154832
if (!hasInstanceValueNode->isCellConstant() || defaultHasInstanceFunction != hasInstanceValueNode->asCell()) {
JSValueRegs hasInstanceValueRegs = hasInstanceValue.jsValueRegs();
- hasInstanceValueNotCell = m_jit.branchIfNotCell(hasInstanceValueRegs);
- notDefaulthasInstanceValue = m_jit.branchPtr(MacroAssembler::NotEqual, hasInstanceValueRegs.payloadGPR(), TrustedImmPtr(defaultHasInstanceFunction));
+ notDefaultHasInstanceValue.append(m_jit.branchIfNotCell(hasInstanceValueRegs));
+ notDefaultHasInstanceValue.append(m_jit.branchPtr(MacroAssembler::NotEqual, hasInstanceValueRegs.payloadGPR(), TrustedImmPtr(defaultHasInstanceFunction)));
}
// Check that constructor 'ImplementsDefaultHasInstance'.
@@ -4649,9 +4648,8 @@
m_jit.test8(MacroAssembler::Zero, MacroAssembler::Address(baseGPR, JSCell::typeInfoFlagsOffset()), MacroAssembler::TrustedImm32(ImplementsDefaultHasInstance), resultGPR);
MacroAssembler::Jump done = m_jit.jump();
- if (!hasInstanceValueNode->isCellConstant()) {
- hasInstanceValueNotCell.link(&m_jit);
- notDefaulthasInstanceValue.link(&m_jit);
+ if (!notDefaultHasInstanceValue.empty()) {
+ notDefaultHasInstanceValue.link(&m_jit);
moveTrueTo(resultGPR);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
