Title: [119300] trunk/Source/_javascript_Core
- Revision
- 119300
- Author
- [email protected]
- Date
- 2012-06-01 16:47:28 -0700 (Fri, 01 Jun 2012)
Log Message
DFG arguments simplification phase uses a node.codeOrigin after appending a node
https://bugs.webkit.org/show_bug.cgi?id=88151
Reviewed by Geoffrey Garen.
The right thing to do is to save the CodeOrigin before appending to the graph.
* dfg/DFGArgumentsSimplificationPhase.cpp:
(JSC::DFG::ArgumentsSimplificationPhase::run):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (119299 => 119300)
--- trunk/Source/_javascript_Core/ChangeLog 2012-06-01 23:18:59 UTC (rev 119299)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-06-01 23:47:28 UTC (rev 119300)
@@ -1,5 +1,17 @@
2012-06-01 Filip Pizlo <[email protected]>
+ DFG arguments simplification phase uses a node.codeOrigin after appending a node
+ https://bugs.webkit.org/show_bug.cgi?id=88151
+
+ Reviewed by Geoffrey Garen.
+
+ The right thing to do is to save the CodeOrigin before appending to the graph.
+
+ * dfg/DFGArgumentsSimplificationPhase.cpp:
+ (JSC::DFG::ArgumentsSimplificationPhase::run):
+
+2012-06-01 Filip Pizlo <[email protected]>
+
DFG should not emit unnecessary speculation checks when performing an int32 to double conversion on
a value that is proved to be a number, predicted to be an int32, but not proved to be an int32
https://bugs.webkit.org/show_bug.cgi?id=88146
Modified: trunk/Source/_javascript_Core/dfg/DFGArgumentsSimplificationPhase.cpp (119299 => 119300)
--- trunk/Source/_javascript_Core/dfg/DFGArgumentsSimplificationPhase.cpp 2012-06-01 23:18:59 UTC (rev 119299)
+++ trunk/Source/_javascript_Core/dfg/DFGArgumentsSimplificationPhase.cpp 2012-06-01 23:47:28 UTC (rev 119300)
@@ -487,19 +487,21 @@
node.setOp(GetMyArgumentsLength);
changed = true;
}
- if (!node.codeOrigin.inlineCallFrame)
+
+ CodeOrigin codeOrigin = node.codeOrigin;
+ if (!codeOrigin.inlineCallFrame)
break;
// We know exactly what this will return. But only after we have checked
// that nobody has escaped our arguments.
- Node check(CheckArgumentsNotCreated, node.codeOrigin);
+ Node check(CheckArgumentsNotCreated, codeOrigin);
check.ref();
NodeIndex checkIndex = m_graph.size();
m_graph.append(check);
insertionSet.append(indexInBlock, checkIndex);
m_graph.convertToConstant(
- nodeIndex, jsNumber(node.codeOrigin.inlineCallFrame->arguments.size() - 1));
+ nodeIndex, jsNumber(codeOrigin.inlineCallFrame->arguments.size() - 1));
changed = true;
break;
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
