Title: [116620] branches/dfgopt/Source/_javascript_Core
- Revision
- 116620
- Author
- [email protected]
- Date
- 2012-05-10 00:53:27 -0700 (Thu, 10 May 2012)
Log Message
DFG should allow inlining in case of certain arity mismatches
https://bugs.webkit.org/show_bug.cgi?id=86059
Reviewed by Geoff Garen.
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleInlining):
Modified Paths
Diff
Modified: branches/dfgopt/Source/_javascript_Core/ChangeLog (116619 => 116620)
--- branches/dfgopt/Source/_javascript_Core/ChangeLog 2012-05-10 07:48:10 UTC (rev 116619)
+++ branches/dfgopt/Source/_javascript_Core/ChangeLog 2012-05-10 07:53:27 UTC (rev 116620)
@@ -1,3 +1,13 @@
+2012-05-09 Filip Pizlo <[email protected]>
+
+ DFG should allow inlining in case of certain arity mismatches
+ https://bugs.webkit.org/show_bug.cgi?id=86059
+
+ Reviewed by Geoff Garen.
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::handleInlining):
+
2012-05-08 Filip Pizlo <[email protected]>
DFG variable capture analysis should work even if the variables arose through inlining
Modified: branches/dfgopt/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (116619 => 116620)
--- branches/dfgopt/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2012-05-10 07:48:10 UTC (rev 116619)
+++ branches/dfgopt/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2012-05-10 07:53:27 UTC (rev 116620)
@@ -1116,9 +1116,10 @@
FunctionExecutable* executable = expectedFunction->jsExecutable();
- // Does the number of arguments we're passing match the arity of the target? We could
- // inline arity check failures, but for simplicity we currently don't.
- if (static_cast<int>(executable->parameterCount()) + 1 != argumentCountIncludingThis)
+ // Does the number of arguments we're passing match the arity of the target? We currently
+ // inline only if the number of arguments passed is greater than or equal to the number
+ // arguments expected.
+ if (static_cast<int>(executable->parameterCount()) + 1 > argumentCountIncludingThis)
return false;
// Have we exceeded inline stack depth, or are we trying to inline a recursive call?
@@ -1183,8 +1184,11 @@
InlineStackEntry inlineStackEntry(this, codeBlock, profiledBlock, m_graph.m_blocks.size() - 1, (VirtualRegister)m_inlineStackTop->remapOperand(callTarget), expectedFunction, (VirtualRegister)m_inlineStackTop->remapOperand(usesResult ? resultOperand : InvalidVirtualRegister), (VirtualRegister)inlineCallFrameStart, kind);
// Link up the argument variable access datas to their argument positions.
- for (int i = 1; i < argumentCountIncludingThis; ++i)
+ for (int i = 1; i < argumentCountIncludingThis; ++i) {
+ if (static_cast<size_t>(i) >= inlineStackEntry.m_argumentPositions.size())
+ break;
inlineStackEntry.m_argumentPositions[i]->addVariable(arguments[i - 1]);
+ }
// This is where the actual inlining really happens.
unsigned oldIndex = m_currentIndex;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
