Title: [134310] branches/safari-536.28-branch/Source/_javascript_Core
- Revision
- 134310
- Author
- [email protected]
- Date
- 2012-11-12 14:36:07 -0800 (Mon, 12 Nov 2012)
Log Message
Merge part 1 of <rdar://problem/12486142>.
Modified Paths
Diff
Modified: branches/safari-536.28-branch/Source/_javascript_Core/ChangeLog (134309 => 134310)
--- branches/safari-536.28-branch/Source/_javascript_Core/ChangeLog 2012-11-12 22:36:01 UTC (rev 134309)
+++ branches/safari-536.28-branch/Source/_javascript_Core/ChangeLog 2012-11-12 22:36:07 UTC (rev 134310)
@@ -1,5 +1,37 @@
2012-11-12 Lucas Forschler <[email protected]>
+ Merge fix for <rdar://problem/12486142>.
+
+ 2012-08-13 Filip Pizlo <[email protected]>
+
+ Value recovery for arguments should always just indicate that the argument is in the register file, and
+ not attempt to claim anything about the tag.
+ <rdar://problem/12046032>
+
+ The code previously attempted to base the value recovery on the VariableAccessData prediction. This is
+ wrong for two reasons: first, SetLocals speculate on the argument-aware prediction, which is different
+ from the prediction, if the argument was used to store different types; and second, even if the
+ argument-aware prediction indicates some unboxed type (int, bool, or cell) then it must be the case
+ that the tag that was stored by the caller would be identical to the tag implied by the prediction -
+ so OSR can just assume that the argument already holds a fully decorated JSValue. Of special note are
+ double predictions: the DFG has never stored unboxed doubles into arguments, so those don't need
+ special treatment here.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+
+ 2012-07-24 Filip Pizlo <[email protected]>
+
+ DFG method checks should keep the receiver of the property access alive until all checks complete.
+ <rdar://problem/11781190>
+
+ Reviewed by Gavin Barraclough.
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::parseBlock):
+
+2012-11-12 Lucas Forschler <[email protected]>
+
Merge r129440
2012-09-24 Filip Pizlo <[email protected]>
Modified: branches/safari-536.28-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (134309 => 134310)
--- branches/safari-536.28-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2012-11-12 22:36:01 UTC (rev 134309)
+++ branches/safari-536.28-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2012-11-12 22:36:07 UTC (rev 134310)
@@ -937,13 +937,8 @@
m_jit.jitAssertHasValidCallFrame();
ASSERT(m_arguments.size() == block.variablesAtHead.numberOfArguments());
- for (size_t i = 0; i < m_arguments.size(); ++i) {
- NodeIndex nodeIndex = block.variablesAtHead.argument(i);
- if (nodeIndex == NoNode || m_jit.graph().argumentIsCaptured(i))
- m_arguments[i] = ValueSource(ValueInRegisterFile);
- else
- m_arguments[i] = ValueSource::forPrediction(at(nodeIndex).variableAccessData()->prediction());
- }
+ for (size_t i = 0; i < m_arguments.size(); ++i)
+ m_arguments[i] = ValueSource(ValueInRegisterFile);
m_state.reset();
m_state.beginBasicBlock(&block);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
