Title: [119292] trunk
- Revision
- 119292
- Author
- [email protected]
- Date
- 2012-06-01 15:44:43 -0700 (Fri, 01 Jun 2012)
Log Message
DFG constant folding search for the last local access skips the immediately previous local access
https://bugs.webkit.org/show_bug.cgi?id=88141
Source/_javascript_Core:
Reviewed by Michael Saboff.
If you use a loop in the style of:
for (i = start; i--;)
then you need to remember that the first value of 'i' that the loop body will see is 'start - 1'.
Hence the following is probably wrong:
for (i = start - 1; i--;)
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::run):
LayoutTests:
Reviewed by Michael Saboff.
* fast/js/dfg-obvious-constant-cfa-expected.txt: Added.
* fast/js/dfg-obvious-constant-cfa.html: Added.
* fast/js/script-tests/dfg-obvious-constant-cfa.js: Added.
(bar.baz):
(bar):
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (119291 => 119292)
--- trunk/LayoutTests/ChangeLog 2012-06-01 22:43:11 UTC (rev 119291)
+++ trunk/LayoutTests/ChangeLog 2012-06-01 22:44:43 UTC (rev 119292)
@@ -1,3 +1,16 @@
+2012-06-01 Filip Pizlo <[email protected]>
+
+ DFG constant folding search for the last local access skips the immediately previous local access
+ https://bugs.webkit.org/show_bug.cgi?id=88141
+
+ Reviewed by Michael Saboff.
+
+ * fast/js/dfg-obvious-constant-cfa-expected.txt: Added.
+ * fast/js/dfg-obvious-constant-cfa.html: Added.
+ * fast/js/script-tests/dfg-obvious-constant-cfa.js: Added.
+ (bar.baz):
+ (bar):
+
2012-06-01 Ryosuke Niwa <[email protected]>
Chromium rebaseline after r119274.
Added: trunk/LayoutTests/fast/js/dfg-obvious-constant-cfa-expected.txt (0 => 119292)
--- trunk/LayoutTests/fast/js/dfg-obvious-constant-cfa-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-obvious-constant-cfa-expected.txt 2012-06-01 22:44:43 UTC (rev 119292)
@@ -0,0 +1,10 @@
+This tests that if the CFA performs constant folding on an obvious set and then get of a captured local, then we don't crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS result is 228300
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/js/dfg-obvious-constant-cfa.html (0 => 119292)
--- trunk/LayoutTests/fast/js/dfg-obvious-constant-cfa.html (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-obvious-constant-cfa.html 2012-06-01 22:44:43 UTC (rev 119292)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/fast/js/script-tests/dfg-obvious-constant-cfa.js (0 => 119292)
--- trunk/LayoutTests/fast/js/script-tests/dfg-obvious-constant-cfa.js (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/dfg-obvious-constant-cfa.js 2012-06-01 22:44:43 UTC (rev 119292)
@@ -0,0 +1,23 @@
+description(
+"This tests that if the CFA performs constant folding on an obvious set and then get of a captured local, then we don't crash."
+);
+
+function bar(a, b) {
+ var x;
+ var y;
+ function baz() {
+ return x + y;
+ }
+ x = 13;
+ y = 16;
+ if (y == 16) {
+ return x + a + b + baz();
+ } else
+ return 24;
+}
+
+var result = 0;
+for (var i = 0; i < 200; ++i)
+ result += bar(i, 1000);
+
+shouldBe("result", "228300");
Modified: trunk/Source/_javascript_Core/ChangeLog (119291 => 119292)
--- trunk/Source/_javascript_Core/ChangeLog 2012-06-01 22:43:11 UTC (rev 119291)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-06-01 22:44:43 UTC (rev 119292)
@@ -1,5 +1,24 @@
2012-06-01 Filip Pizlo <[email protected]>
+ DFG constant folding search for the last local access skips the immediately previous local access
+ https://bugs.webkit.org/show_bug.cgi?id=88141
+
+ Reviewed by Michael Saboff.
+
+ If you use a loop in the style of:
+
+ for (i = start; i--;)
+
+ then you need to remember that the first value of 'i' that the loop body will see is 'start - 1'.
+ Hence the following is probably wrong:
+
+ for (i = start - 1; i--;)
+
+ * dfg/DFGConstantFoldingPhase.cpp:
+ (JSC::DFG::ConstantFoldingPhase::run):
+
+2012-06-01 Filip Pizlo <[email protected]>
+
DFG constant folding should be OK with GetLocal of captured variables having a constant
https://bugs.webkit.org/show_bug.cgi?id=88137
Modified: trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp (119291 => 119292)
--- trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp 2012-06-01 22:43:11 UTC (rev 119291)
+++ trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp 2012-06-01 22:44:43 UTC (rev 119292)
@@ -84,7 +84,7 @@
} else {
ASSERT(indexInBlock > 0);
// Must search for the previous access to this local.
- for (BlockIndex subIndexInBlock = indexInBlock - 1; subIndexInBlock--;) {
+ for (BlockIndex subIndexInBlock = indexInBlock; subIndexInBlock--;) {
NodeIndex subNodeIndex = block->at(subIndexInBlock);
Node& subNode = m_graph[subNodeIndex];
if (!subNode.shouldGenerate())
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
