Title: [204698] trunk
- Revision
- 204698
- Author
- [email protected]
- Date
- 2016-08-21 13:36:49 -0700 (Sun, 21 Aug 2016)
Log Message
Unreviewed, rolling out r204697
https://bugs.webkit.org/show_bug.cgi?id=161029
JSTests:
* typeProfiler/int52-dfg.js: Removed.
(test): Deleted.
* typeProfiler/number-filter-dfg.js: Removed.
(test): Deleted.
Source/_javascript_Core:
32bit is OK. DFGSpeculativeJIT64.cpp shortcut also need some cares.
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
Modified Paths
Removed Paths
Diff
Modified: trunk/JSTests/ChangeLog (204697 => 204698)
--- trunk/JSTests/ChangeLog 2016-08-21 19:45:50 UTC (rev 204697)
+++ trunk/JSTests/ChangeLog 2016-08-21 20:36:49 UTC (rev 204698)
@@ -1,5 +1,15 @@
2016-08-21 Yusuke Suzuki <[email protected]>
+ Unreviewed, rolling out r204697
+ https://bugs.webkit.org/show_bug.cgi?id=161029
+
+ * typeProfiler/int52-dfg.js: Removed.
+ (test): Deleted.
+ * typeProfiler/number-filter-dfg.js: Removed.
+ (test): Deleted.
+
+2016-08-21 Yusuke Suzuki <[email protected]>
+
[DFG] Should not fixup AnyIntUse in 32_64
https://bugs.webkit.org/show_bug.cgi?id=161029
Deleted: trunk/JSTests/typeProfiler/int52-dfg.js (204697 => 204698)
--- trunk/JSTests/typeProfiler/int52-dfg.js 2016-08-21 19:45:50 UTC (rev 204697)
+++ trunk/JSTests/typeProfiler/int52-dfg.js 2016-08-21 20:36:49 UTC (rev 204698)
@@ -1,15 +0,0 @@
-load("./driver/driver.js");
-
-function test()
-{
- var ok = 0;
- for (var i = 0; i < 1e4; ++i) {
- ok += 0xfffffffff; // Int52
- }
- return ok;
-}
-test();
-
-var types = findTypeForExpression(test, "ok += 0x");
-assert(types.instructionTypeSet.primitiveTypeNames.length === 1, "Primitive type names should one candidate.");
-assert(types.instructionTypeSet.primitiveTypeNames.indexOf(T.Integer) !== -1, "Primitive type names should contain 'Integer'");
Deleted: trunk/JSTests/typeProfiler/number-filter-dfg.js (204697 => 204698)
--- trunk/JSTests/typeProfiler/number-filter-dfg.js 2016-08-21 19:45:50 UTC (rev 204697)
+++ trunk/JSTests/typeProfiler/number-filter-dfg.js 2016-08-21 20:36:49 UTC (rev 204698)
@@ -1,16 +0,0 @@
-load("./driver/driver.js");
-
-function test(value)
-{
- var ok = 0.5;
- ok += value;
- return ok;
-}
-noInline(test);
-for (var i = 0; i < 1e4; ++i)
- test(1.2);
-test(0.5);
-var types = findTypeForExpression(test, "ok += value");
-assert(types.instructionTypeSet.primitiveTypeNames.length === 2, "Primitive type names should two candidates.");
-assert(types.instructionTypeSet.primitiveTypeNames.indexOf(T.Integer) !== -1, "Primitive type names should contain 'Integer'");
-assert(types.instructionTypeSet.primitiveTypeNames.indexOf(T.Number) !== -1, "Primitive type names should contain 'Number'");
Modified: trunk/Source/_javascript_Core/ChangeLog (204697 => 204698)
--- trunk/Source/_javascript_Core/ChangeLog 2016-08-21 19:45:50 UTC (rev 204697)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-08-21 20:36:49 UTC (rev 204698)
@@ -1,5 +1,15 @@
2016-08-21 Yusuke Suzuki <[email protected]>
+ Unreviewed, rolling out r204697
+ https://bugs.webkit.org/show_bug.cgi?id=161029
+
+ 32bit is OK. DFGSpeculativeJIT64.cpp shortcut also need some cares.
+
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode):
+
+2016-08-21 Yusuke Suzuki <[email protected]>
+
[DFG] Should not fixup AnyIntUse in 32_64
https://bugs.webkit.org/show_bug.cgi?id=161029
Modified: trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (204697 => 204698)
--- trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2016-08-21 19:45:50 UTC (rev 204697)
+++ trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2016-08-21 20:36:49 UTC (rev 204698)
@@ -1459,23 +1459,12 @@
RefPtr<TypeSet> typeSet = node->typeLocation()->m_instructionTypeSet;
RuntimeTypeMask seenTypes = typeSet->seenTypes();
if (typeSet->doesTypeConformTo(TypeAnyInt)) {
- if (node->child1()->shouldSpeculateInt32()) {
+ if (node->child1()->shouldSpeculateInt32())
fixEdge<Int32Use>(node->child1());
- node->remove();
- break;
- }
-
- if (enableInt52()) {
+ else
fixEdge<AnyIntUse>(node->child1());
- node->remove();
- break;
- }
-
- // Must not perform fixEdge<NumberUse> here since the type set only includes TypeAnyInt. Double values should be logged.
- }
-
- if (typeSet->doesTypeConformTo(TypeNumber | TypeAnyInt) && ((seenTypes & TypeNumber) && (seenTypes & TypeAnyInt))) {
- // NumberUse can pass TypeNumber and TypeAnyInt. Thus, this node removal is allowed only if both TypeNumber and TypeAnyInt are logged in the type set.
+ node->remove();
+ } else if (typeSet->doesTypeConformTo(TypeNumber | TypeAnyInt)) {
fixEdge<NumberUse>(node->child1());
node->remove();
} else if (typeSet->doesTypeConformTo(TypeString)) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
