Title: [260549] trunk/Source/_javascript_Core
- Revision
- 260549
- Author
- sbar...@apple.com
- Date
- 2020-04-22 19:14:22 -0700 (Wed, 22 Apr 2020)
Log Message
Edge use kind asserts are wrong for BigInt32 on ValueBitLShift
https://bugs.webkit.org/show_bug.cgi?id=210872
Reviewed by Yusuke Suzuki, Mark Lam, and Robin Morisset.
This is already covered by the v8 tests Yusuke checked in.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::emitUntypedOrAnyBigIntBitOp):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileValueBitLShift):
(JSC::FTL::DFG::LowerDFGToB3::emitBinaryBitOpSnippet):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (260548 => 260549)
--- trunk/Source/_javascript_Core/ChangeLog 2020-04-23 01:22:36 UTC (rev 260548)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-04-23 02:14:22 UTC (rev 260549)
@@ -1,3 +1,18 @@
+2020-04-22 Saam Barati <sbar...@apple.com>
+
+ Edge use kind asserts are wrong for BigInt32 on ValueBitLShift
+ https://bugs.webkit.org/show_bug.cgi?id=210872
+
+ Reviewed by Yusuke Suzuki, Mark Lam, and Robin Morisset.
+
+ This is already covered by the v8 tests Yusuke checked in.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::emitUntypedOrAnyBigIntBitOp):
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileValueBitLShift):
+ (JSC::FTL::DFG::LowerDFGToB3::emitBinaryBitOpSnippet):
+
2020-04-22 Yusuke Suzuki <ysuz...@apple.com>
[JSC] JSBigInt inc operation does not produce right HeapBigInt zero
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (260548 => 260549)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2020-04-23 01:22:36 UTC (rev 260548)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2020-04-23 02:14:22 UTC (rev 260549)
@@ -3619,7 +3619,7 @@
Edge& leftChild = node->child1();
Edge& rightChild = node->child2();
- ASSERT(leftChild.useKind() == UntypedUse || leftChild.useKind() == AnyBigIntUse || rightChild.useKind() == UntypedUse || rightChild.useKind() == AnyBigIntUse);
+ DFG_ASSERT(m_jit.graph(), node, node->isBinaryUseKind(UntypedUse) || node->isBinaryUseKind(AnyBigIntUse) || node->isBinaryUseKind(HeapBigIntUse) || node->isBinaryUseKind(BigInt32Use));
if (isKnownNotNumber(leftChild.node()) || isKnownNotNumber(rightChild.node())) {
JSValueOperand left(this, leftChild, ManualOperandSpeculation);
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (260548 => 260549)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2020-04-23 01:22:36 UTC (rev 260548)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2020-04-23 02:14:22 UTC (rev 260549)
@@ -3470,7 +3470,7 @@
return;
}
- ASSERT(m_node->isBinaryUseKind(UntypedUse));
+ DFG_ASSERT(m_graph, m_node, m_node->isBinaryUseKind(UntypedUse) || m_node->isBinaryUseKind(AnyBigIntUse) || m_node->isBinaryUseKind(BigInt32Use));
emitBinaryBitOpSnippet<JITLeftShiftGenerator>(operationValueBitLShift);
}
@@ -14752,7 +14752,7 @@
{
Node* node = m_node;
- ASSERT(node->isBinaryUseKind(UntypedUse) || node->isBinaryUseKind(AnyBigIntUse));
+ DFG_ASSERT(m_graph, node, node->isBinaryUseKind(UntypedUse) || node->isBinaryUseKind(AnyBigIntUse) || node->isBinaryUseKind(BigInt32Use));
LValue left = lowJSValue(node->child1(), ManualOperandSpeculation);
LValue right = lowJSValue(node->child2(), ManualOperandSpeculation);
speculate(node, node->child1());
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
