Title: [261293] trunk/Source/_javascript_Core
- Revision
- 261293
- Author
- ryanhad...@apple.com
- Date
- 2020-05-07 09:19:18 -0700 (Thu, 07 May 2020)
Log Message
Unreviewed, reverting r261260.
Caused 26 JSC test failures
Reverted changeset:
"DFG ByVal nodes with ArrayModes should clobberTop until Fixup
phase runs."
https://bugs.webkit.org/show_bug.cgi?id=211531
https://trac.webkit.org/changeset/261260
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (261292 => 261293)
--- trunk/Source/_javascript_Core/ChangeLog 2020-05-07 16:14:10 UTC (rev 261292)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-05-07 16:19:18 UTC (rev 261293)
@@ -1,3 +1,16 @@
+2020-05-07 Ryan Haddad <ryanhad...@apple.com>
+
+ Unreviewed, reverting r261260.
+
+ Caused 26 JSC test failures
+
+ Reverted changeset:
+
+ "DFG ByVal nodes with ArrayModes should clobberTop until Fixup
+ phase runs."
+ https://bugs.webkit.org/show_bug.cgi?id=211531
+ https://trac.webkit.org/changeset/261260
+
2020-05-07 Mark Lam <mark....@apple.com>
Fix broken exceptionFuzz tests.
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (261292 => 261293)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2020-05-07 16:14:10 UTC (rev 261292)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2020-05-07 16:19:18 UTC (rev 261293)
@@ -6901,9 +6901,6 @@
Node* iterable = get(bytecode.m_iterable);
Node* butterfly = addToGraph(GetButterfly, iterable);
Node* length = addToGraph(GetArrayLength, OpInfo(arrayMode.asWord()), iterable, butterfly);
- // GetArrayLength is pessimized prior to fixup.
- m_exitOK = true;
- addToGraph(ExitOK);
Node* isOutOfBounds = addToGraph(CompareGreaterEq, Edge(index, Int32Use), Edge(length, Int32Use));
isDone = addToGraph(ArithBitOr, isDone, isOutOfBounds);
Modified: trunk/Source/_javascript_Core/dfg/DFGClobberize.h (261292 => 261293)
--- trunk/Source/_javascript_Core/dfg/DFGClobberize.h 2020-05-07 16:14:10 UTC (rev 261292)
+++ trunk/Source/_javascript_Core/dfg/DFGClobberize.h 2020-05-07 16:19:18 UTC (rev 261293)
@@ -155,11 +155,6 @@
read(World);
write(Heap);
};
-
- // Since Fixup can widen our ArrayModes based on profiling from other nodes we pessimistically assume
- // all nodes with an ArrayMode can clobber top.
- if (graph.m_planStage < PlanStage::AfterFixup && node->hasArrayMode())
- return clobberTop();
switch (node->op()) {
case JSConstant:
Modified: trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (261292 => 261293)
--- trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2020-05-07 16:14:10 UTC (rev 261292)
+++ trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2020-05-07 16:19:18 UTC (rev 261293)
@@ -180,10 +180,6 @@
{
NodeType op = node->op();
-#if ASSERT_ENABLED
- bool usedToClobberExitState = clobbersExitState(m_graph, node);
-#endif
-
switch (op) {
case SetLocal: {
// This gets handled by fixupGetAndSetLocalsInBlock().
@@ -1285,7 +1281,7 @@
node->setArrayMode(ArrayMode(Array::Generic, node->arrayMode().action()));
break;
}
-
+
node->setArrayMode(
node->arrayMode().refine(
m_graph, node, base->prediction(), index->prediction()));
@@ -2724,12 +2720,6 @@
break;
#endif // not ASSERT_ENABLED
}
-
-#if ASSERT_ENABLED
- // It would be invalid for Fixup to take a node that didn't clobber exit state and mark it as clobbering afterwords.
- DFG_ASSERT(m_graph, node, usedToClobberExitState || !clobbersExitState(m_graph, node));
-#endif
-
}
void watchHavingABadTime(Node* node)
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
