Title: [243206] trunk/Source/_javascript_Core
Revision
243206
Author
[email protected]
Date
2019-03-20 09:17:44 -0700 (Wed, 20 Mar 2019)

Log Message

AI rule for ValueBitNot/ValueBitXor/ValueBitAnd/ValueBitOr is wrong
https://bugs.webkit.org/show_bug.cgi?id=195980

Reviewed by Yusuke Suzuki.

They were all saying they could be type: (SpecBoolInt32, SpecBigInt)
However, they should have been type: (SpecInt32Only, SpecBigInt)

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (243205 => 243206)


--- trunk/Source/_javascript_Core/ChangeLog	2019-03-20 16:17:21 UTC (rev 243205)
+++ trunk/Source/_javascript_Core/ChangeLog	2019-03-20 16:17:44 UTC (rev 243206)
@@ -1,3 +1,16 @@
+2019-03-20  Saam Barati  <[email protected]>
+
+        AI rule for ValueBitNot/ValueBitXor/ValueBitAnd/ValueBitOr is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=195980
+
+        Reviewed by Yusuke Suzuki.
+
+        They were all saying they could be type: (SpecBoolInt32, SpecBigInt)
+        However, they should have been type: (SpecInt32Only, SpecBigInt)
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
 2019-03-20  Michael Catanzaro  <[email protected]>
 
         Remove copyRef() calls added in r243163

Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (243205 => 243206)


--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h	2019-03-20 16:17:21 UTC (rev 243205)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h	2019-03-20 16:17:44 UTC (rev 243206)
@@ -389,7 +389,7 @@
             setTypeForNode(node, SpecBigInt);
         else {
             clobberWorld();
-            setTypeForNode(node, SpecBoolInt32 | SpecBigInt);
+            setTypeForNode(node, SpecInt32Only | SpecBigInt);
         }
 
         break;
@@ -414,7 +414,7 @@
             setTypeForNode(node, SpecBigInt);
         else {
             clobberWorld();
-            setTypeForNode(node, SpecBoolInt32 | SpecBigInt);
+            setTypeForNode(node, SpecInt32Only | SpecBigInt);
         }
         break;
             
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to