Title: [139068] trunk/Source/_javascript_Core
- Revision
- 139068
- Author
- [email protected]
- Date
- 2013-01-08 09:56:22 -0800 (Tue, 08 Jan 2013)
Log Message
DFG should backwards-propagate NodeUsedAsValue for Phantom
https://bugs.webkit.org/show_bug.cgi?id=106299
Reviewed by Mark Hahnenberg.
This is currently benign because Phantom is only inserted by the bytecode parser for
things that already happen to be used in contexts that backwards propagate
NodeUsedAsValue. But that doesn't change the fact that the semantics of Phantom are
that the value can be arbitrarily used by the baseline JIT.
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (139067 => 139068)
--- trunk/Source/_javascript_Core/ChangeLog 2013-01-08 17:51:48 UTC (rev 139067)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-01-08 17:56:22 UTC (rev 139068)
@@ -1,5 +1,20 @@
2013-01-07 Filip Pizlo <[email protected]>
+ DFG should backwards-propagate NodeUsedAsValue for Phantom
+ https://bugs.webkit.org/show_bug.cgi?id=106299
+
+ Reviewed by Mark Hahnenberg.
+
+ This is currently benign because Phantom is only inserted by the bytecode parser for
+ things that already happen to be used in contexts that backwards propagate
+ NodeUsedAsValue. But that doesn't change the fact that the semantics of Phantom are
+ that the value can be arbitrarily used by the baseline JIT.
+
+ * dfg/DFGPredictionPropagationPhase.cpp:
+ (JSC::DFG::PredictionPropagationPhase::propagate):
+
+2013-01-07 Filip Pizlo <[email protected]>
+
Rationalize closure call heuristics and profiling
https://bugs.webkit.org/show_bug.cgi?id=106270
Modified: trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp (139067 => 139068)
--- trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp 2013-01-08 17:51:48 UTC (rev 139067)
+++ trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp 2013-01-08 17:56:22 UTC (rev 139068)
@@ -800,11 +800,11 @@
case GlobalVarWatchpoint:
case GarbageValue:
case InheritorIDWatchpoint:
+ case Phantom:
changed |= mergeDefaultFlags(node);
break;
// These gets ignored because it doesn't do anything.
- case Phantom:
case InlineStart:
case Nop:
case CountExecution:
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
