Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 20d58337eba8c5f0fcb7ff485a5b29cf88b004ac
https://github.com/WebKit/WebKit/commit/20d58337eba8c5f0fcb7ff485a5b29cf88b004ac
Author: Yusuke Suzuki <[email protected]>
Date: 2025-04-30 (Wed, 30 Apr 2025)
Changed paths:
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Log Message:
-----------
[JSC] DFG BackwardsPropagation should be more robust
https://bugs.webkit.org/show_bug.cgi?id=292318
rdar://150349703
Reviewed by Yijia Huang.
Some of DFG BackwardsPropagation nodes are not properly propagating
flags (e.g. ValueRep). The reason is that DFGSpeculativeJIT etc. is
using NodeBytecodeUsesAsOther flag to select the result format, and
changing these flags from Fixup phase makes it confused. But this is
simply not appropriate: since FixupPhase already set result flags, we
should just use that information in DFGSpeculativeJIT. By refactoring
this part, we can just make DFG BackwardsPropagation sane with these
nodes. We also use bytecodeCanIgnoreNegativeZero in FTLLowerDFGToB3's
MultiGetByVal with Int52 result since these flags are now appropriately
propagated through this phase.
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp:
(JSC::DFG::BackwardsPropagationPhase::propagate):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compileGetByVal):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileGetByValImpl):
(JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByVal):
Canonical link: https://commits.webkit.org/294346@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
