[webkit-changes] [119464] trunk

Mon, 04 Jun 2012 23:40:55 -0700

Title: [119464] trunk
Revision
119464
Author
[email protected]
Date
2012-06-04 23:40:48 -0700 (Mon, 04 Jun 2012)

Log Message

DFG CFG simplification should correct the variables at the head of the predecessor block
https://bugs.webkit.org/show_bug.cgi?id=88284

Reviewed by Geoffrey Garen.

Source/_javascript_Core: 

* dfg/DFGCFGSimplificationPhase.cpp:
(JSC::DFG::CFGSimplificationPhase::mergeBlocks):

LayoutTests: 

* fast/js/dfg-constant-fold-first-local-read-after-block-merge-expected.txt: Added.
* fast/js/dfg-constant-fold-first-local-read-after-block-merge.html: Added.
* fast/js/script-tests/dfg-constant-fold-first-local-read-after-block-merge.js: Added.
(foo):
(bar):

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (119463 => 119464)


--- trunk/LayoutTests/ChangeLog	2012-06-05 06:38:30 UTC (rev 119463)
+++ trunk/LayoutTests/ChangeLog	2012-06-05 06:40:48 UTC (rev 119464)
@@ -1,3 +1,16 @@
+2012-06-04  Filip Pizlo  <[email protected]>
+
+        DFG CFG simplification should correct the variables at the head of the predecessor block
+        https://bugs.webkit.org/show_bug.cgi?id=88284
+
+        Reviewed by Geoffrey Garen.
+
+        * fast/js/dfg-constant-fold-first-local-read-after-block-merge-expected.txt: Added.
+        * fast/js/dfg-constant-fold-first-local-read-after-block-merge.html: Added.
+        * fast/js/script-tests/dfg-constant-fold-first-local-read-after-block-merge.js: Added.
+        (foo):
+        (bar):
+
 2012-06-04  Emil A Eklund  <[email protected]>
 
         Unreviewed chromium windows rebaseline for r119456.

Added: trunk/LayoutTests/fast/js/dfg-constant-fold-first-local-read-after-block-merge-expected.txt (0 => 119464)


--- trunk/LayoutTests/fast/js/dfg-constant-fold-first-local-read-after-block-merge-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-constant-fold-first-local-read-after-block-merge-expected.txt	2012-06-05 06:40:48 UTC (rev 119464)
@@ -0,0 +1,209 @@
+Tests that the DFG doesn't crash if we constant fold the first read of a local variable in a block that is the result of merging two blocks, where the first doesn't touch the local and the second reads it.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS bar(5) is 42
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

Added: trunk/LayoutTests/fast/js/dfg-constant-fold-first-local-read-after-block-merge.html (0 => 119464)


--- trunk/LayoutTests/fast/js/dfg-constant-fold-first-local-read-after-block-merge.html	                        (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-constant-fold-first-local-read-after-block-merge.html	2012-06-05 06:40:48 UTC (rev 119464)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>

Added: trunk/LayoutTests/fast/js/script-tests/dfg-constant-fold-first-local-read-after-block-merge.js (0 => 119464)


--- trunk/LayoutTests/fast/js/script-tests/dfg-constant-fold-first-local-read-after-block-merge.js	                        (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/dfg-constant-fold-first-local-read-after-block-merge.js	2012-06-05 06:40:48 UTC (rev 119464)
@@ -0,0 +1,24 @@
+description(
+"Tests that the DFG doesn't crash if we constant fold the first read of a local variable in a block that is the result of merging two blocks, where the first doesn't touch the local and the second reads it."
+);
+
+function foo(x, y) {
+    var o = {};
+    if (y == 5) {
+        o.f = 42;
+    }
+    var z = o.f;
+    if (x == 5) {
+        if (y == 5) {
+            return z;
+        }
+    }
+}
+
+function bar(x) {
+    return foo(x, 5);
+}
+
+for (var i = 0; i < 200; ++i)
+    shouldBe("bar(5)", "42");
+

Modified: trunk/Source/_javascript_Core/ChangeLog (119463 => 119464)


--- trunk/Source/_javascript_Core/ChangeLog	2012-06-05 06:38:30 UTC (rev 119463)
+++ trunk/Source/_javascript_Core/ChangeLog	2012-06-05 06:40:48 UTC (rev 119464)
@@ -1,3 +1,13 @@
+2012-06-04  Filip Pizlo  <[email protected]>
+
+        DFG CFG simplification should correct the variables at the head of the predecessor block
+        https://bugs.webkit.org/show_bug.cgi?id=88284
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+
 2012-06-04  Geoffrey Garen  <[email protected]>
 
         Unreviewed.

Modified: trunk/Source/_javascript_Core/dfg/DFGCFGSimplificationPhase.cpp (119463 => 119464)


--- trunk/Source/_javascript_Core/dfg/DFGCFGSimplificationPhase.cpp	2012-06-05 06:38:30 UTC (rev 119463)
+++ trunk/Source/_javascript_Core/dfg/DFGCFGSimplificationPhase.cpp	2012-06-05 06:40:48 UTC (rev 119464)
@@ -632,6 +632,18 @@
                 
                 NodeIndex atFirstIndex = firstBlock->variablesAtTail.operand(node.local());
                 m_graph.changeEdge(node.children.child1(), Edge(skipGetLocal(atFirstIndex)), node.shouldGenerate());
+                
+                if (node.op() != GetLocal)
+                    break;
+                
+                NodeIndex atFirstHeadIndex = firstBlock->variablesAtHead.operand(node.local());
+                if (atFirstHeadIndex == NoNode)
+                    break;
+                
+                if (m_graph[atFirstHeadIndex].op() != Phi)
+                    break;
+                
+                firstBlock->variablesAtHead.operand(node.local()) = nodeIndex;
                 break;
             }
                 

_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes

Reply via email to