Title: [210186] releases/WebKitGTK/webkit-2.14
- Revision
- 210186
- Author
- [email protected]
- Date
- 2016-12-28 01:14:46 -0800 (Wed, 28 Dec 2016)
Log Message
Merge r206472 - B3::lowerMacros forgets to before->updatePredecessorsAfter() when lowering ChillMod on ARM64
https://bugs.webkit.org/show_bug.cgi?id=162644
Reviewed by Keith Miller.
JSTests:
* stress/chill-mod-chill-mod.js: Added.
(foo):
Source/_javascript_Core:
If you forget to update the predecessors of your successors, then bad things will happen if you
do something that requires accurate predecessors for correctness. lowerMacros() uses
BlockInsertionSet, which relies on accurate predecessors.
* b3/B3LowerMacros.cpp:
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.14/JSTests/ChangeLog (210185 => 210186)
--- releases/WebKitGTK/webkit-2.14/JSTests/ChangeLog 2016-12-28 09:11:02 UTC (rev 210185)
+++ releases/WebKitGTK/webkit-2.14/JSTests/ChangeLog 2016-12-28 09:14:46 UTC (rev 210186)
@@ -1,3 +1,13 @@
+2016-09-27 Filip Pizlo <[email protected]>
+
+ B3::lowerMacros forgets to before->updatePredecessorsAfter() when lowering ChillMod on ARM64
+ https://bugs.webkit.org/show_bug.cgi?id=162644
+
+ Reviewed by Keith Miller.
+
+ * stress/chill-mod-chill-mod.js: Added.
+ (foo):
+
2016-09-08 Saam Barati <[email protected]>
We should inline operationConvertJSValueToBoolean into JIT code
Added: releases/WebKitGTK/webkit-2.14/JSTests/stress/chill-mod-chill-mod.js (0 => 210186)
--- releases/WebKitGTK/webkit-2.14/JSTests/stress/chill-mod-chill-mod.js (rev 0)
+++ releases/WebKitGTK/webkit-2.14/JSTests/stress/chill-mod-chill-mod.js 2016-12-28 09:14:46 UTC (rev 210186)
@@ -0,0 +1,10 @@
+function foo(a, b)
+{
+ return (~~(a % b)) + (~~(b % a));
+}
+
+noInline(foo);
+
+for (var i = 0; i < 10000; ++i)
+ foo(1, 2);
+
Modified: releases/WebKitGTK/webkit-2.14/Source/_javascript_Core/ChangeLog (210185 => 210186)
--- releases/WebKitGTK/webkit-2.14/Source/_javascript_Core/ChangeLog 2016-12-28 09:11:02 UTC (rev 210185)
+++ releases/WebKitGTK/webkit-2.14/Source/_javascript_Core/ChangeLog 2016-12-28 09:14:46 UTC (rev 210186)
@@ -1,3 +1,16 @@
+2016-09-27 Filip Pizlo <[email protected]>
+
+ B3::lowerMacros forgets to before->updatePredecessorsAfter() when lowering ChillMod on ARM64
+ https://bugs.webkit.org/show_bug.cgi?id=162644
+
+ Reviewed by Keith Miller.
+
+ If you forget to update the predecessors of your successors, then bad things will happen if you
+ do something that requires accurate predecessors for correctness. lowerMacros() uses
+ BlockInsertionSet, which relies on accurate predecessors.
+
+ * b3/B3LowerMacros.cpp:
+
2016-09-13 Mark Lam <[email protected]>
DFG NewArrayBuffer node should watch for "have a bad time" state change.
Modified: releases/WebKitGTK/webkit-2.14/Source/_javascript_Core/b3/B3LowerMacros.cpp (210185 => 210186)
--- releases/WebKitGTK/webkit-2.14/Source/_javascript_Core/b3/B3LowerMacros.cpp 2016-12-28 09:11:02 UTC (rev 210185)
+++ releases/WebKitGTK/webkit-2.14/Source/_javascript_Core/b3/B3LowerMacros.cpp 2016-12-28 09:14:46 UTC (rev 210186)
@@ -147,6 +147,7 @@
normalResult->setPhi(phi);
zeroResult->setPhi(phi);
m_value->replaceWithIdentity(phi);
+ before->updatePredecessorsAfter();
m_changed = true;
} else
makeDivisionChill(Mod);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
