Title: [259742] trunk
- Revision
- 259742
- Author
- [email protected]
- Date
- 2020-04-08 12:06:39 -0700 (Wed, 08 Apr 2020)
Log Message
[JSC] MultiDeleteByOffset should tell correct result AbstractValue in AI
https://bugs.webkit.org/show_bug.cgi?id=210175
<rdar://problem/61433817>
Reviewed by Saam Barati.
JSTests:
* stress/multi-delete-by-offset-ai-result.js: Added.
(foo):
Source/_javascript_Core:
Since the result value of MultiDeleteByOffset should be used, AI should set boolean AbstractValue as a result of MultiDeleteByOffset.
We also add MultiDeleteByOffset to DFGStoreBarrierInsertionPhase since it can write StructureID: this means that write-barrier is necessary.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGStoreBarrierInsertionPhase.cpp:
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (259741 => 259742)
--- trunk/JSTests/ChangeLog 2020-04-08 19:02:28 UTC (rev 259741)
+++ trunk/JSTests/ChangeLog 2020-04-08 19:06:39 UTC (rev 259742)
@@ -1,3 +1,14 @@
+2020-04-08 Yusuke Suzuki <[email protected]>
+
+ [JSC] MultiDeleteByOffset should tell correct result AbstractValue in AI
+ https://bugs.webkit.org/show_bug.cgi?id=210175
+ <rdar://problem/61433817>
+
+ Reviewed by Saam Barati.
+
+ * stress/multi-delete-by-offset-ai-result.js: Added.
+ (foo):
+
2020-04-07 Yusuke Suzuki <[email protected]>
[JSC] Collect-continuously thread should take m_collectContinuouslyLock while it is waking up concurrent collector thread
Added: trunk/JSTests/stress/multi-delete-by-offset-ai-result.js (0 => 259742)
--- trunk/JSTests/stress/multi-delete-by-offset-ai-result.js (rev 0)
+++ trunk/JSTests/stress/multi-delete-by-offset-ai-result.js 2020-04-08 19:06:39 UTC (rev 259742)
@@ -0,0 +1,15 @@
+//@ runDefault("--validateAbstractInterpreterState=1")
+
+function foo(obj) {
+ return delete obj['x'];
+}
+noInline(foo);
+
+let o = {};
+
+for (let i = 0; i < 10000; ++i) {
+ Object.defineProperty(o, 'x', {});
+ foo({});
+ foo({x:1});
+}
+
Modified: trunk/Source/_javascript_Core/ChangeLog (259741 => 259742)
--- trunk/Source/_javascript_Core/ChangeLog 2020-04-08 19:02:28 UTC (rev 259741)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-04-08 19:06:39 UTC (rev 259742)
@@ -1,3 +1,18 @@
+2020-04-08 Yusuke Suzuki <[email protected]>
+
+ [JSC] MultiDeleteByOffset should tell correct result AbstractValue in AI
+ https://bugs.webkit.org/show_bug.cgi?id=210175
+ <rdar://problem/61433817>
+
+ Reviewed by Saam Barati.
+
+ Since the result value of MultiDeleteByOffset should be used, AI should set boolean AbstractValue as a result of MultiDeleteByOffset.
+ We also add MultiDeleteByOffset to DFGStoreBarrierInsertionPhase since it can write StructureID: this means that write-barrier is necessary.
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * dfg/DFGStoreBarrierInsertionPhase.cpp:
+
2020-04-08 Angelos Oikonomopoulos <[email protected]>
Enable offlineasm debug annotations for GCC
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (259741 => 259742)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2020-04-08 19:02:28 UTC (rev 259741)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2020-04-08 19:06:39 UTC (rev 259742)
@@ -3743,6 +3743,7 @@
observeTransitions(clobberLimit, transitions);
if (forNode(node->child1()).changeStructure(m_graph, newSet) == Contradiction)
m_state.setIsValid(false);
+ setNonCellTypeForNode(node, SpecBoolean);
break;
}
Modified: trunk/Source/_javascript_Core/dfg/DFGStoreBarrierInsertionPhase.cpp (259741 => 259742)
--- trunk/Source/_javascript_Core/dfg/DFGStoreBarrierInsertionPhase.cpp 2020-04-08 19:02:28 UTC (rev 259741)
+++ trunk/Source/_javascript_Core/dfg/DFGStoreBarrierInsertionPhase.cpp 2020-04-08 19:06:39 UTC (rev 259742)
@@ -297,7 +297,8 @@
break;
}
- case MultiPutByOffset: {
+ case MultiPutByOffset:
+ case MultiDeleteByOffset: {
considerBarrier(m_node->child1());
break;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
