Title: [240878] trunk
- Revision
- 240878
- Author
- [email protected]
- Date
- 2019-02-01 14:47:19 -0800 (Fri, 01 Feb 2019)
Log Message
Remove invalid assertion in DFG's compileDoubleRep().
https://bugs.webkit.org/show_bug.cgi?id=194130
<rdar://problem/47699474>
Reviewed by Saam Barati.
JSTests:
* stress/constant-fold-double-rep-into-double-constant.js: Added.
Source/_javascript_Core:
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileDoubleRep):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (240877 => 240878)
--- trunk/JSTests/ChangeLog 2019-02-01 22:07:47 UTC (rev 240877)
+++ trunk/JSTests/ChangeLog 2019-02-01 22:47:19 UTC (rev 240878)
@@ -1,3 +1,13 @@
+2019-02-01 Mark Lam <[email protected]>
+
+ Remove invalid assertion in DFG's compileDoubleRep().
+ https://bugs.webkit.org/show_bug.cgi?id=194130
+ <rdar://problem/47699474>
+
+ Reviewed by Saam Barati.
+
+ * stress/constant-fold-double-rep-into-double-constant.js: Added.
+
2019-01-30 Ross Kirsling <[email protected]>
Import latest Test262 updates.
Added: trunk/JSTests/stress/constant-fold-double-rep-into-double-constant.js (0 => 240878)
--- trunk/JSTests/stress/constant-fold-double-rep-into-double-constant.js (rev 0)
+++ trunk/JSTests/stress/constant-fold-double-rep-into-double-constant.js 2019-02-01 22:47:19 UTC (rev 240878)
@@ -0,0 +1,14 @@
+function bar(o) {
+ for (let i = 0; i < 2; i++)
+ o[i] = undefined;
+ o.length = undefined;
+ return o;
+}
+
+function foo(a) {
+ bar(a);
+ undefined + bar(0) + bar(0);
+ for(let i = 0; i < 10000000; i++) {}
+}
+
+foo({});
Modified: trunk/Source/_javascript_Core/ChangeLog (240877 => 240878)
--- trunk/Source/_javascript_Core/ChangeLog 2019-02-01 22:07:47 UTC (rev 240877)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-02-01 22:47:19 UTC (rev 240878)
@@ -1,3 +1,14 @@
+2019-02-01 Mark Lam <[email protected]>
+
+ Remove invalid assertion in DFG's compileDoubleRep().
+ https://bugs.webkit.org/show_bug.cgi?id=194130
+ <rdar://problem/47699474>
+
+ Reviewed by Saam Barati.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileDoubleRep):
+
2019-02-01 Yusuke Suzuki <[email protected]>
[JSC] Unify CodeBlock IsoSubspaces
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (240877 => 240878)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2019-02-01 22:07:47 UTC (rev 240877)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2019-02-01 22:47:19 UTC (rev 240878)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2011-2018 Apple Inc. All rights reserved.
+ * Copyright (C) 2011-2019 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -2585,8 +2585,6 @@
case NotCellUse:
case NumberUse: {
- ASSERT(!node->child1()->isNumberConstant()); // This should have been constant folded.
-
SpeculatedType possibleTypes = m_state.forNode(node->child1()).m_type;
if (isInt32Speculation(possibleTypes)) {
SpeculateInt32Operand op1(this, node->child1(), ManualOperandSpeculation);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
