Title: [221807] trunk
- Revision
- 221807
- Author
- [email protected]
- Date
- 2017-09-08 22:19:47 -0700 (Fri, 08 Sep 2017)
Log Message
[DFG] NewArrayWithSize(size)'s size does not care negative zero
https://bugs.webkit.org/show_bug.cgi?id=176300
Reviewed by Saam Barati.
JSTests:
* stress/new-array-with-size-div.js: Added.
(shouldBe):
(test):
(i.i):
Source/_javascript_Core:
NewArrayWithSize(size)'s size does not care negative zero as
is the same to NewTypedArray. We propagate this information
in DFGBackwardsPropagationPhase. This removes negative zero
check in kraken fft's deinterleave function.
* dfg/DFGBackwardsPropagationPhase.cpp:
(JSC::DFG::BackwardsPropagationPhase::propagate):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (221806 => 221807)
--- trunk/JSTests/ChangeLog 2017-09-09 03:32:59 UTC (rev 221806)
+++ trunk/JSTests/ChangeLog 2017-09-09 05:19:47 UTC (rev 221807)
@@ -1,5 +1,17 @@
2017-09-08 Yusuke Suzuki <[email protected]>
+ [DFG] NewArrayWithSize(size)'s size does not care negative zero
+ https://bugs.webkit.org/show_bug.cgi?id=176300
+
+ Reviewed by Saam Barati.
+
+ * stress/new-array-with-size-div.js: Added.
+ (shouldBe):
+ (test):
+ (i.i):
+
+2017-09-08 Yusuke Suzuki <[email protected]>
+
[DFG] PutByVal with Array::Generic is too generic
https://bugs.webkit.org/show_bug.cgi?id=176345
Added: trunk/JSTests/stress/new-array-with-size-div.js (0 => 221807)
--- trunk/JSTests/stress/new-array-with-size-div.js (rev 0)
+++ trunk/JSTests/stress/new-array-with-size-div.js 2017-09-09 05:19:47 UTC (rev 221807)
@@ -0,0 +1,22 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+function test(length, number)
+{
+ return new Array(length / number);
+}
+noInline(test);
+
+var value = 0;
+var number = 0;
+for (var i = 0; i < 1e4; ++i) {
+ value = i * 2;
+ number = 2;
+ if (i === (1e4 - 1)) {
+ value = 0;
+ number = -1;
+ }
+ shouldBe(test(value, number).length, (value / number));
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (221806 => 221807)
--- trunk/Source/_javascript_Core/ChangeLog 2017-09-09 03:32:59 UTC (rev 221806)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-09-09 05:19:47 UTC (rev 221807)
@@ -1,5 +1,20 @@
2017-09-08 Yusuke Suzuki <[email protected]>
+ [DFG] NewArrayWithSize(size)'s size does not care negative zero
+ https://bugs.webkit.org/show_bug.cgi?id=176300
+
+ Reviewed by Saam Barati.
+
+ NewArrayWithSize(size)'s size does not care negative zero as
+ is the same to NewTypedArray. We propagate this information
+ in DFGBackwardsPropagationPhase. This removes negative zero
+ check in kraken fft's deinterleave function.
+
+ * dfg/DFGBackwardsPropagationPhase.cpp:
+ (JSC::DFG::BackwardsPropagationPhase::propagate):
+
+2017-09-08 Yusuke Suzuki <[email protected]>
+
[DFG] PutByVal with Array::Generic is too generic
https://bugs.webkit.org/show_bug.cgi?id=176345
Modified: trunk/Source/_javascript_Core/dfg/DFGBackwardsPropagationPhase.cpp (221806 => 221807)
--- trunk/Source/_javascript_Core/dfg/DFGBackwardsPropagationPhase.cpp 2017-09-09 03:32:59 UTC (rev 221806)
+++ trunk/Source/_javascript_Core/dfg/DFGBackwardsPropagationPhase.cpp 2017-09-09 05:19:47 UTC (rev 221807)
@@ -335,12 +335,8 @@
break;
}
+ case NewTypedArray:
case NewArrayWithSize: {
- node->child1()->mergeFlags(NodeBytecodeUsesAsValue | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex);
- break;
- }
-
- case NewTypedArray: {
// Negative zero is not observable. NaN versus undefined are only observable
// in that you would get a different exception message. So, like, whatever: we
// claim here that NaN v. undefined is observable.
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
