Title: [225971] trunk/Source/_javascript_Core
- Revision
- 225971
- Author
- utatane....@gmail.com
- Date
- 2017-12-15 05:58:59 -0800 (Fri, 15 Dec 2017)
Log Message
Unreviewed, 32bit JSEmpty is not nullptr + CellTag
https://bugs.webkit.org/show_bug.cgi?id=180804
Add 32bit path for WeakMapGet.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileWeakMapGet):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (225970 => 225971)
--- trunk/Source/_javascript_Core/ChangeLog 2017-12-15 13:14:36 UTC (rev 225970)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-12-15 13:58:59 UTC (rev 225971)
@@ -1,3 +1,13 @@
+2017-12-15 Yusuke Suzuki <utatane....@gmail.com>
+
+ Unreviewed, 32bit JSEmpty is not nullptr + CellTag
+ https://bugs.webkit.org/show_bug.cgi?id=180804
+
+ Add 32bit path for WeakMapGet.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileWeakMapGet):
+
2017-12-14 Saam Barati <sbar...@apple.com>
The CleanUp after LICM is erroneously removing a Check
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (225970 => 225971)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2017-12-15 13:14:36 UTC (rev 225970)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2017-12-15 13:58:59 UTC (rev 225971)
@@ -11054,17 +11054,28 @@
m_jit.add32(TrustedImm32(1), indexGPR);
m_jit.jump().linkTo(loop, &m_jit);
+#if USE(JSVALUE32_64)
notPresentInTable.link(&m_jit);
+ m_jit.moveValue(JSValue(), resultRegs);
+ auto notPresentInTableDone = m_jit.jump();
+
found.link(&m_jit);
-
- // Empty bucket has JSEmpty value. Empty key is JSEmpty. If empty bucket is found, we can use the same path used for the case of finding a bucket.
- if (node->child1().useKind() == WeakSetObjectUse) {
-#if USE(JSVALUE32_64)
+ if (node->child1().useKind() == WeakSetObjectUse)
m_jit.move(TrustedImm32(JSValue::CellTag), resultRegs.tagGPR());
-#endif
- } else
+ else
m_jit.loadValue(MacroAssembler::Address(bucketGPR, WeakMapBucket<WeakMapBucketDataKeyValue>::offsetOfValue()), resultRegs);
+ notPresentInTableDone.link(&m_jit);
+#else
+ notPresentInTable.link(&m_jit);
+ found.link(&m_jit);
+
+ // In 64bit environment, Empty bucket has JSEmpty value. Empty key is JSEmpty.
+ // If empty bucket is found, we can use the same path used for the case of finding a bucket.
+ if (node->child1().useKind() == WeakMapObjectUse)
+ m_jit.loadValue(MacroAssembler::Address(bucketGPR, WeakMapBucket<WeakMapBucketDataKeyValue>::offsetOfValue()), resultRegs);
+#endif
+
jsValueResult(resultRegs, node);
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
