Title: [206767] trunk/Source/_javascript_Core
- Revision
- 206767
- Author
- [email protected]
- Date
- 2016-10-04 02:19:48 -0700 (Tue, 04 Oct 2016)
Log Message
Follow up fix to GetMapBucket and MapHash speculating on child node types.
To fix this, on 32-bit platforms, we do not speculate on the child
type since we just call into C code for these nodes.
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (206766 => 206767)
--- trunk/Source/_javascript_Core/ChangeLog 2016-10-04 06:28:55 UTC (rev 206766)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-10-04 09:19:48 UTC (rev 206767)
@@ -1,3 +1,12 @@
+2016-10-04 Saam Barati <[email protected]>
+
+ Follow up fix to GetMapBucket and MapHash speculating on child node types.
+ To fix this, on 32-bit platforms, we do not speculate on the child
+ type since we just call into C code for these nodes.
+
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode):
+
2016-10-03 Saam Barati <[email protected]>
GetMapBucket node should speculate on the type of its 'key' child
Modified: trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (206766 => 206767)
--- trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2016-10-04 06:28:55 UTC (rev 206766)
+++ trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2016-10-04 09:19:48 UTC (rev 206767)
@@ -1588,6 +1588,7 @@
else
RELEASE_ASSERT_NOT_REACHED();
+#if USE(JSVALUE64)
if (node->child2()->shouldSpeculateBoolean())
fixEdge<BooleanUse>(node->child2());
else if (node->child2()->shouldSpeculateInt32())
@@ -1602,6 +1603,9 @@
fixEdge<CellUse>(node->child2());
else
fixEdge<UntypedUse>(node->child2());
+#else
+ fixEdge<UntypedUse>(node->child2());
+#endif // USE(JSVALUE64)
fixEdge<Int32Use>(node->child3());
break;
@@ -1615,6 +1619,7 @@
break;
case MapHash: {
+#if USE(JSVALUE64)
if (node->child1()->shouldSpeculateBoolean()) {
fixEdge<BooleanUse>(node->child1());
break;
@@ -1646,6 +1651,9 @@
}
fixEdge<UntypedUse>(node->child1());
+#else
+ fixEdge<UntypedUse>(node->child1());
+#endif // USE(JSVALUE64)
break;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
