Title: [205601] releases/WebKitGTK/webkit-2.14/Source/_javascript_Core
- Revision
- 205601
- Author
- [email protected]
- Date
- 2016-09-08 00:57:23 -0700 (Thu, 08 Sep 2016)
Log Message
Merge r205216 - [JSC] Some arith nodes are too pessimistic with the types supported on the fast path
https://bugs.webkit.org/show_bug.cgi?id=161410
Patch by Benjamin Poulain <[email protected]> on 2016-08-30
Reviewed by Geoffrey Garen.
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
DoubleRep is able to convert numbers, undefined, booleans and null.
I was too pessimistic when I gated the double implementations
on number-or-boolean speculation. We can just let DoubleRep convert
the other cases as long as it is not a Cell.
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.14/Source/_javascript_Core/ChangeLog (205600 => 205601)
--- releases/WebKitGTK/webkit-2.14/Source/_javascript_Core/ChangeLog 2016-09-08 07:56:05 UTC (rev 205600)
+++ releases/WebKitGTK/webkit-2.14/Source/_javascript_Core/ChangeLog 2016-09-08 07:57:23 UTC (rev 205601)
@@ -1,3 +1,17 @@
+2016-08-30 Benjamin Poulain <[email protected]>
+
+ [JSC] Some arith nodes are too pessimistic with the types supported on the fast path
+ https://bugs.webkit.org/show_bug.cgi?id=161410
+
+ Reviewed by Geoffrey Garen.
+
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode):
+ DoubleRep is able to convert numbers, undefined, booleans and null.
+ I was too pessimistic when I gated the double implementations
+ on number-or-boolean speculation. We can just let DoubleRep convert
+ the other cases as long as it is not a Cell.
+
2016-08-30 Chris Dumez <[email protected]>
Object.setPrototypeOf() should throw when used on a cross-origin Window / Location object
Modified: releases/WebKitGTK/webkit-2.14/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (205600 => 205601)
--- releases/WebKitGTK/webkit-2.14/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2016-09-08 07:56:05 UTC (rev 205600)
+++ releases/WebKitGTK/webkit-2.14/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2016-09-08 07:57:23 UTC (rev 205601)
@@ -343,7 +343,7 @@
break;
}
- if (node->child1()->shouldSpeculateNumberOrBoolean()) {
+ if (node->child1()->shouldSpeculateNotCell()) {
fixDoubleOrBooleanEdge(node->child1());
node->clearFlags(NodeMustGenerate);
} else
@@ -400,7 +400,7 @@
case ArithSin:
case ArithSqrt: {
Edge& child1 = node->child1();
- if (child1->shouldSpeculateNumberOrBoolean()) {
+ if (child1->shouldSpeculateNotCell()) {
fixDoubleOrBooleanEdge(child1);
node->clearFlags(NodeMustGenerate);
} else
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
