Title: [206472] trunk
- Revision
- 206472
- Author
- fpi...@apple.com
- Date
- 2016-09-27 16:54:28 -0700 (Tue, 27 Sep 2016)
Log Message
B3::lowerMacros forgets to before->updatePredecessorsAfter() when lowering ChillMod on ARM64
https://bugs.webkit.org/show_bug.cgi?id=162644
Reviewed by Keith Miller.
JSTests:
* stress/chill-mod-chill-mod.js: Added.
(foo):
Source/_javascript_Core:
If you forget to update the predecessors of your successors, then bad things will happen if you
do something that requires accurate predecessors for correctness. lowerMacros() uses
BlockInsertionSet, which relies on accurate predecessors.
* b3/B3LowerMacros.cpp:
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (206471 => 206472)
--- trunk/JSTests/ChangeLog 2016-09-27 23:41:45 UTC (rev 206471)
+++ trunk/JSTests/ChangeLog 2016-09-27 23:54:28 UTC (rev 206472)
@@ -1,3 +1,13 @@
+2016-09-27 Filip Pizlo <fpi...@apple.com>
+
+ B3::lowerMacros forgets to before->updatePredecessorsAfter() when lowering ChillMod on ARM64
+ https://bugs.webkit.org/show_bug.cgi?id=162644
+
+ Reviewed by Keith Miller.
+
+ * stress/chill-mod-chill-mod.js: Added.
+ (foo):
+
2016-09-26 Csaba Osztrogonác <o...@inf.u-szeged.hu>
Skip stress/string-joining-long-strings-should-not-crash.js on memory limited devices
Added: trunk/JSTests/stress/chill-mod-chill-mod.js (0 => 206472)
--- trunk/JSTests/stress/chill-mod-chill-mod.js (rev 0)
+++ trunk/JSTests/stress/chill-mod-chill-mod.js 2016-09-27 23:54:28 UTC (rev 206472)
@@ -0,0 +1,10 @@
+function foo(a, b)
+{
+ return (~~(a % b)) + (~~(b % a));
+}
+
+noInline(foo);
+
+for (var i = 0; i < 10000; ++i)
+ foo(1, 2);
+
Modified: trunk/Source/_javascript_Core/ChangeLog (206471 => 206472)
--- trunk/Source/_javascript_Core/ChangeLog 2016-09-27 23:41:45 UTC (rev 206471)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-09-27 23:54:28 UTC (rev 206472)
@@ -1,3 +1,16 @@
+2016-09-27 Filip Pizlo <fpi...@apple.com>
+
+ B3::lowerMacros forgets to before->updatePredecessorsAfter() when lowering ChillMod on ARM64
+ https://bugs.webkit.org/show_bug.cgi?id=162644
+
+ Reviewed by Keith Miller.
+
+ If you forget to update the predecessors of your successors, then bad things will happen if you
+ do something that requires accurate predecessors for correctness. lowerMacros() uses
+ BlockInsertionSet, which relies on accurate predecessors.
+
+ * b3/B3LowerMacros.cpp:
+
2016-09-27 JF Bastien <jfbast...@apple.com>
Speed up Heap::isMarkedConcurrently
Modified: trunk/Source/_javascript_Core/b3/B3LowerMacros.cpp (206471 => 206472)
--- trunk/Source/_javascript_Core/b3/B3LowerMacros.cpp 2016-09-27 23:41:45 UTC (rev 206471)
+++ trunk/Source/_javascript_Core/b3/B3LowerMacros.cpp 2016-09-27 23:54:28 UTC (rev 206472)
@@ -147,6 +147,7 @@
normalResult->setPhi(phi);
zeroResult->setPhi(phi);
m_value->replaceWithIdentity(phi);
+ before->updatePredecessorsAfter();
m_changed = true;
} else
makeDivisionChill(Mod);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
