[webkit-changes] [119303] trunk

Fri, 01 Jun 2012 17:22:38 -0700

Title: [119303] trunk
Revision
119303
Author
[email protected]
Date
2012-06-01 17:22:31 -0700 (Fri, 01 Jun 2012)

Log Message

DFG CFA should know that PutByVal can clobber the world
https://bugs.webkit.org/show_bug.cgi?id=88155

Reviewed by Gavin Barraclough.

Source/_javascript_Core: 

* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):

LayoutTests: 

* fast/js/dfg-putbyval-cfa-clobber-expected.txt: Added.
* fast/js/dfg-putbyval-cfa-clobber.html: Added.
* fast/js/script-tests/dfg-putbyval-cfa-clobber.js: Added.
(foo.bar):
(foo):

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (119302 => 119303)


--- trunk/LayoutTests/ChangeLog	2012-06-02 00:09:04 UTC (rev 119302)
+++ trunk/LayoutTests/ChangeLog	2012-06-02 00:22:31 UTC (rev 119303)
@@ -1,5 +1,18 @@
 2012-06-01  Filip Pizlo  <[email protected]>
 
+        DFG CFA should know that PutByVal can clobber the world
+        https://bugs.webkit.org/show_bug.cgi?id=88155
+
+        Reviewed by Gavin Barraclough.
+
+        * fast/js/dfg-putbyval-cfa-clobber-expected.txt: Added.
+        * fast/js/dfg-putbyval-cfa-clobber.html: Added.
+        * fast/js/script-tests/dfg-putbyval-cfa-clobber.js: Added.
+        (foo.bar):
+        (foo):
+
+2012-06-01  Filip Pizlo  <[email protected]>
+
         DFG should not emit unnecessary speculation checks when performing an int32 to double conversion on
         a value that is proved to be a number, predicted to be an int32, but not proved to be an int32
         https://bugs.webkit.org/show_bug.cgi?id=88146

Added: trunk/LayoutTests/fast/js/dfg-putbyval-cfa-clobber-expected.txt (0 => 119303)


--- trunk/LayoutTests/fast/js/dfg-putbyval-cfa-clobber-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-putbyval-cfa-clobber-expected.txt	2012-06-02 00:22:31 UTC (rev 119303)
@@ -0,0 +1,209 @@
+Tests that CFA knows that PutByVal can clobber the world.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS foo(array, -1) is 57
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

Added: trunk/LayoutTests/fast/js/dfg-putbyval-cfa-clobber.html (0 => 119303)


--- trunk/LayoutTests/fast/js/dfg-putbyval-cfa-clobber.html	                        (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-putbyval-cfa-clobber.html	2012-06-02 00:22:31 UTC (rev 119303)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>

Added: trunk/LayoutTests/fast/js/script-tests/dfg-putbyval-cfa-clobber.js (0 => 119303)


--- trunk/LayoutTests/fast/js/script-tests/dfg-putbyval-cfa-clobber.js	                        (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/dfg-putbyval-cfa-clobber.js	2012-06-02 00:22:31 UTC (rev 119303)
@@ -0,0 +1,22 @@
+description(
+"Tests that CFA knows that PutByVal can clobber the world."
+);
+
+var theBar;
+
+function foo(a, b) {
+    var x;
+    function bar() {
+        x = 57;
+    }
+    theBar = bar;
+    x = 42;
+    a[b] = 73;
+    return x;
+}
+
+array = [];
+array.__defineSetter__("-1", function(v) { theBar(); });
+
+for (var i = 0; i < 200; ++i)
+    shouldBe("foo(array, -1)", "57");

Modified: trunk/Source/_javascript_Core/ChangeLog (119302 => 119303)


--- trunk/Source/_javascript_Core/ChangeLog	2012-06-02 00:09:04 UTC (rev 119302)
+++ trunk/Source/_javascript_Core/ChangeLog	2012-06-02 00:22:31 UTC (rev 119303)
@@ -1,5 +1,15 @@
 2012-06-01  Filip Pizlo  <[email protected]>
 
+        DFG CFA should know that PutByVal can clobber the world
+        https://bugs.webkit.org/show_bug.cgi?id=88155
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+
+2012-06-01  Filip Pizlo  <[email protected]>
+
         DFG CFA should mark basic blocks as having constants if local accesses yield constants
         https://bugs.webkit.org/show_bug.cgi?id=88153

Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp (119302 => 119303)


--- trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp	2012-06-02 00:09:04 UTC (rev 119302)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractState.cpp	2012-06-02 00:22:31 UTC (rev 119303)
@@ -1016,6 +1016,8 @@
         ASSERT(m_graph[node.child1()].shouldSpeculateArray());
         forNode(node.child1()).filter(PredictArray);
         forNode(node.child2()).filter(PredictInt32);
+        if (node.op() == PutByVal)
+            clobberWorld(node.codeOrigin, indexInBlock);
         break;
     }
             

_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes

Reply via email to