Title: [254733] trunk
- Revision
- 254733
- Author
- [email protected]
- Date
- 2020-01-16 19:47:54 -0800 (Thu, 16 Jan 2020)
Log Message
Revert 254725 since it breaks tests
https://bugs.webkit.org/show_bug.cgi?id=206391
Unreviewed, revert.
JSTests:
* stress/allocation-sinking-puthint-control-flow-2.js: Removed.
Source/_javascript_Core:
* dfg/DFGObjectAllocationSinkingPhase.cpp:
Modified Paths
Removed Paths
Diff
Modified: trunk/JSTests/ChangeLog (254732 => 254733)
--- trunk/JSTests/ChangeLog 2020-01-17 03:03:12 UTC (rev 254732)
+++ trunk/JSTests/ChangeLog 2020-01-17 03:47:54 UTC (rev 254733)
@@ -1,3 +1,12 @@
+2020-01-16 Keith Miller <[email protected]>
+
+ Revert 254725 since it breaks tests
+ https://bugs.webkit.org/show_bug.cgi?id=206391
+
+ Unreviewed, revert.
+
+ * stress/allocation-sinking-puthint-control-flow-2.js: Removed.
+
2020-01-16 Tadeu Zagallo <[email protected]>
Object allocation sinking is missing PutHint for allocations unreachable in the graph
Deleted: trunk/JSTests/stress/allocation-sinking-puthint-control-flow-2.js (254732 => 254733)
--- trunk/JSTests/stress/allocation-sinking-puthint-control-flow-2.js 2020-01-17 03:03:12 UTC (rev 254732)
+++ trunk/JSTests/stress/allocation-sinking-puthint-control-flow-2.js 2020-01-17 03:47:54 UTC (rev 254733)
@@ -1,16 +0,0 @@
-//@ runDefault("--useConcurrentJIT=0", "--jitPolicyScale=0")
-
-function f() {
- var x = {};
- x = 0;
- var handler = {
- construct: function () {
- x;
- }
- };
- for (let i = 0; i < 1; i++)
- (function () { i });
- new Proxy(function() { }, handler);
-}
-f();
-f();
Modified: trunk/Source/_javascript_Core/ChangeLog (254732 => 254733)
--- trunk/Source/_javascript_Core/ChangeLog 2020-01-17 03:03:12 UTC (rev 254732)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-01-17 03:47:54 UTC (rev 254733)
@@ -1,3 +1,12 @@
+2020-01-16 Keith Miller <[email protected]>
+
+ Revert 254725 since it breaks tests
+ https://bugs.webkit.org/show_bug.cgi?id=206391
+
+ Unreviewed, revert.
+
+ * dfg/DFGObjectAllocationSinkingPhase.cpp:
+
2020-01-16 Tadeu Zagallo <[email protected]>
Object allocation sinking is missing PutHint for sunken allocations
Modified: trunk/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp (254732 => 254733)
--- trunk/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp 2020-01-17 03:03:12 UTC (rev 254732)
+++ trunk/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp 2020-01-17 03:47:54 UTC (rev 254733)
@@ -409,10 +409,8 @@
Node* follow(PromotedHeapLocation location) const
{
const Allocation& base = m_allocations.find(location.base())->value;
- if (base.isEscapedAllocation())
- return nullptr;
+ auto iter = base.fields().find(location.descriptor());
- auto iter = base.fields().find(location.descriptor());
if (iter == base.fields().end())
return nullptr;
@@ -1948,7 +1946,7 @@
availabilityCalculator.m_availability, identifier, phiDef->value());
for (PromotedHeapLocation location : hintsForPhi[variable->index()]) {
- if (m_heap.onlyLocalAllocation(location)) {
+ if (m_heap.onlyLocalAllocation(location.base())) {
m_insertionSet.insert(0,
location.createHint(m_graph, block->at(0)->origin.withInvalidExit(), phiDef->value()));
m_localMapping.set(location, phiDef->value());
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
