Diff
Modified: tags/Safari-537.51.1/LayoutTests/ChangeLog (152797 => 152798)
--- tags/Safari-537.51.1/LayoutTests/ChangeLog 2013-07-17 19:49:44 UTC (rev 152797)
+++ tags/Safari-537.51.1/LayoutTests/ChangeLog 2013-07-17 19:52:20 UTC (rev 152798)
@@ -1,3 +1,21 @@
+2013-07-17 Lucas Forschler <[email protected]>
+
+ Merge r152742
+
+ 2013-07-16 Filip Pizlo <[email protected]>
+
+ MakeRope fixup shouldn't lead to an Identity without kids
+ https://bugs.webkit.org/show_bug.cgi?id=118745
+
+ Reviewed by Mark Hahnenberg.
+
+ * fast/js/dfg-make-rope-all-empty-strings.html: Added.
+ * fast/js/dfg-make-rope-all-empty-strings-expected.txt: Added.
+ * fast/js/jsc-test-list:
+ * fast/js/script-tests/dfg-make-rope-all-empty-strings.js: Added.
+ (foo):
+ (bar):
+
2013-07-16 Lucas Forschler <[email protected]>
Rollout r152703
Copied: tags/Safari-537.51.1/LayoutTests/fast/js/dfg-make-rope-all-empty-strings-expected.txt (from rev 152742, trunk/LayoutTests/fast/js/dfg-make-rope-all-empty-strings-expected.txt) (0 => 152798)
--- tags/Safari-537.51.1/LayoutTests/fast/js/dfg-make-rope-all-empty-strings-expected.txt (rev 0)
+++ tags/Safari-537.51.1/LayoutTests/fast/js/dfg-make-rope-all-empty-strings-expected.txt 2013-07-17 19:52:20 UTC (rev 152798)
@@ -0,0 +1,109 @@
+Check that the DFG can handle MakeRope or ValueAdd on all empty strings.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: tags/Safari-537.51.1/LayoutTests/fast/js/dfg-make-rope-all-empty-strings.html (from rev 152742, trunk/LayoutTests/fast/js/dfg-make-rope-all-empty-strings.html) (0 => 152798)
--- tags/Safari-537.51.1/LayoutTests/fast/js/dfg-make-rope-all-empty-strings.html (rev 0)
+++ tags/Safari-537.51.1/LayoutTests/fast/js/dfg-make-rope-all-empty-strings.html 2013-07-17 19:52:20 UTC (rev 152798)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Modified: tags/Safari-537.51.1/LayoutTests/fast/js/jsc-test-list (152797 => 152798)
--- tags/Safari-537.51.1/LayoutTests/fast/js/jsc-test-list 2013-07-17 19:49:44 UTC (rev 152797)
+++ tags/Safari-537.51.1/LayoutTests/fast/js/jsc-test-list 2013-07-17 19:52:20 UTC (rev 152798)
@@ -181,6 +181,7 @@
fast/js/dfg-intrinsic-side-effect-assignment-osr-exit
fast/js/dfg-intrinsic-unused-this
fast/js/dfg-intrinsic-unused-this-method-check
+fast/js/dfg-make-rope-all-empty-strings
fast/js/dfg-max-backwards-propagation
fast/js/dfg-min-backwards-propagation
fast/js/dfg-min-max
Copied: tags/Safari-537.51.1/LayoutTests/fast/js/script-tests/dfg-make-rope-all-empty-strings.js (from rev 152742, trunk/LayoutTests/fast/js/script-tests/dfg-make-rope-all-empty-strings.js) (0 => 152798)
--- tags/Safari-537.51.1/LayoutTests/fast/js/script-tests/dfg-make-rope-all-empty-strings.js (rev 0)
+++ tags/Safari-537.51.1/LayoutTests/fast/js/script-tests/dfg-make-rope-all-empty-strings.js 2013-07-17 19:52:20 UTC (rev 152798)
@@ -0,0 +1,15 @@
+description(
+"Check that the DFG can handle MakeRope or ValueAdd on all empty strings."
+);
+
+function foo(a, b) {
+ return a + b;
+}
+
+function bar() {
+ return foo("", "");
+}
+
+for (var i = 0; i < 100; ++i)
+ shouldBe("bar()", "\"\"");
+
Modified: tags/Safari-537.51.1/Source/_javascript_Core/ChangeLog (152797 => 152798)
--- tags/Safari-537.51.1/Source/_javascript_Core/ChangeLog 2013-07-17 19:49:44 UTC (rev 152797)
+++ tags/Safari-537.51.1/Source/_javascript_Core/ChangeLog 2013-07-17 19:52:20 UTC (rev 152798)
@@ -1,3 +1,23 @@
+2013-07-17 Lucas Forschler <[email protected]>
+
+ Merge r152742
+
+ 2013-07-16 Filip Pizlo <[email protected]>
+
+ MakeRope fixup shouldn't lead to an Identity without kids
+ https://bugs.webkit.org/show_bug.cgi?id=118745
+
+ Reviewed by Mark Hahnenberg.
+
+ Make the empty string pruning part of fixupMakeRope() stop if it's on the last child.
+
+ Make Node::convertToIdentity release-assert that it has exactly one kid.
+
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupMakeRope):
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::convertToIdentity):
+
2013-07-15 Lucas Forschler <[email protected]>
Merge r152613
Modified: tags/Safari-537.51.1/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (152797 => 152798)
--- tags/Safari-537.51.1/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2013-07-17 19:49:44 UTC (rev 152797)
+++ tags/Safari-537.51.1/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2013-07-17 19:52:20 UTC (rev 152798)
@@ -960,6 +960,11 @@
JSString* string = jsCast<JSString*>(m_graph.valueOfJSConstant(edge.node()).asCell());
if (string->length())
continue;
+
+ // Don't allow the MakeRope to have zero children.
+ if (!i && !node->child2())
+ break;
+
node->children.removeEdge(i--);
}
Modified: tags/Safari-537.51.1/Source/_javascript_Core/dfg/DFGNode.h (152797 => 152798)
--- tags/Safari-537.51.1/Source/_javascript_Core/dfg/DFGNode.h 2013-07-17 19:49:44 UTC (rev 152797)
+++ tags/Safari-537.51.1/Source/_javascript_Core/dfg/DFGNode.h 2013-07-17 19:52:20 UTC (rev 152798)
@@ -221,6 +221,8 @@
void convertToIdentity()
{
+ RELEASE_ASSERT(child1());
+ RELEASE_ASSERT(!child2());
setOpAndDefaultNonExitFlags(Identity);
}
