Diff
Modified: trunk/LayoutTests/ChangeLog (152741 => 152742)
--- trunk/LayoutTests/ChangeLog 2013-07-16 21:34:12 UTC (rev 152741)
+++ trunk/LayoutTests/ChangeLog 2013-07-16 21:41:06 UTC (rev 152742)
@@ -1,3 +1,17 @@
+2013-07-16 Filip Pizlo <[email protected]>
+
+ MakeRope fixup shouldn't lead to an Identity without kids
+ https://bugs.webkit.org/show_bug.cgi?id=118745
+
+ Reviewed by Mark Hahnenberg.
+
+ * fast/js/dfg-make-rope-all-empty-strings.html: Added.
+ * fast/js/dfg-make-rope-all-empty-strings-expected.txt: Added.
+ * fast/js/jsc-test-list:
+ * fast/js/script-tests/dfg-make-rope-all-empty-strings.js: Added.
+ (foo):
+ (bar):
+
2013-07-16 Roger Fong <[email protected]>
Unreviewed rebaseline test added in r152612 for Apple Windows port.
Added: trunk/LayoutTests/fast/js/dfg-make-rope-all-empty-strings-expected.txt (0 => 152742)
--- trunk/LayoutTests/fast/js/dfg-make-rope-all-empty-strings-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-make-rope-all-empty-strings-expected.txt 2013-07-16 21:41:06 UTC (rev 152742)
@@ -0,0 +1,109 @@
+Check that the DFG can handle MakeRope or ValueAdd on all empty strings.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/js/dfg-make-rope-all-empty-strings.html (0 => 152742)
--- trunk/LayoutTests/fast/js/dfg-make-rope-all-empty-strings.html (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-make-rope-all-empty-strings.html 2013-07-16 21:41:06 UTC (rev 152742)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Modified: trunk/LayoutTests/fast/js/jsc-test-list (152741 => 152742)
--- trunk/LayoutTests/fast/js/jsc-test-list 2013-07-16 21:34:12 UTC (rev 152741)
+++ trunk/LayoutTests/fast/js/jsc-test-list 2013-07-16 21:41:06 UTC (rev 152742)
@@ -181,6 +181,7 @@
fast/js/dfg-intrinsic-side-effect-assignment-osr-exit
fast/js/dfg-intrinsic-unused-this
fast/js/dfg-intrinsic-unused-this-method-check
+fast/js/dfg-make-rope-all-empty-strings
fast/js/dfg-max-backwards-propagation
fast/js/dfg-min-backwards-propagation
fast/js/dfg-min-max
Added: trunk/LayoutTests/fast/js/script-tests/dfg-make-rope-all-empty-strings.js (0 => 152742)
--- trunk/LayoutTests/fast/js/script-tests/dfg-make-rope-all-empty-strings.js (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/dfg-make-rope-all-empty-strings.js 2013-07-16 21:41:06 UTC (rev 152742)
@@ -0,0 +1,15 @@
+description(
+"Check that the DFG can handle MakeRope or ValueAdd on all empty strings."
+);
+
+function foo(a, b) {
+ return a + b;
+}
+
+function bar() {
+ return foo("", "");
+}
+
+for (var i = 0; i < 100; ++i)
+ shouldBe("bar()", "\"\"");
+
Modified: trunk/Source/_javascript_Core/ChangeLog (152741 => 152742)
--- trunk/Source/_javascript_Core/ChangeLog 2013-07-16 21:34:12 UTC (rev 152741)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-07-16 21:41:06 UTC (rev 152742)
@@ -1,3 +1,19 @@
+2013-07-16 Filip Pizlo <[email protected]>
+
+ MakeRope fixup shouldn't lead to an Identity without kids
+ https://bugs.webkit.org/show_bug.cgi?id=118745
+
+ Reviewed by Mark Hahnenberg.
+
+ Make the empty string pruning part of fixupMakeRope() stop if it's on the last child.
+
+ Make Node::convertToIdentity release-assert that it has exactly one kid.
+
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupMakeRope):
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::convertToIdentity):
+
2013-07-16 Mark Hahnenberg <[email protected]>
Remove reference to JSValueStructSupport.h from JSExport.h
Modified: trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (152741 => 152742)
--- trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2013-07-16 21:34:12 UTC (rev 152741)
+++ trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2013-07-16 21:41:06 UTC (rev 152742)
@@ -960,6 +960,11 @@
JSString* string = jsCast<JSString*>(m_graph.valueOfJSConstant(edge.node()).asCell());
if (string->length())
continue;
+
+ // Don't allow the MakeRope to have zero children.
+ if (!i && !node->child2())
+ break;
+
node->children.removeEdge(i--);
}
Modified: trunk/Source/_javascript_Core/dfg/DFGNode.h (152741 => 152742)
--- trunk/Source/_javascript_Core/dfg/DFGNode.h 2013-07-16 21:34:12 UTC (rev 152741)
+++ trunk/Source/_javascript_Core/dfg/DFGNode.h 2013-07-16 21:41:06 UTC (rev 152742)
@@ -221,6 +221,8 @@
void convertToIdentity()
{
+ RELEASE_ASSERT(child1());
+ RELEASE_ASSERT(!child2());
setOpAndDefaultNonExitFlags(Identity);
}
