Title: [192088] trunk/Source/_javascript_Core
- Revision
- 192088
- Author
- [email protected]
- Date
- 2015-11-05 16:13:57 -0800 (Thu, 05 Nov 2015)
Log Message
Unreviewed, add FIXMEs referencing https://bugs.webkit.org/show_bug.cgi?id=150958 and
https://bugs.webkit.org/show_bug.cgi?id=150954.
* b3/B3LowerToAir.cpp:
(JSC::B3::Air::LowerToAir::createGenericCompare):
* b3/B3ReduceStrength.cpp:
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (192087 => 192088)
--- trunk/Source/_javascript_Core/ChangeLog 2015-11-06 00:06:56 UTC (rev 192087)
+++ trunk/Source/_javascript_Core/ChangeLog 2015-11-06 00:13:57 UTC (rev 192088)
@@ -1,3 +1,12 @@
+2015-11-05 Filip Pizlo <[email protected]>
+
+ Unreviewed, add FIXMEs referencing https://bugs.webkit.org/show_bug.cgi?id=150958 and
+ https://bugs.webkit.org/show_bug.cgi?id=150954.
+
+ * b3/B3LowerToAir.cpp:
+ (JSC::B3::Air::LowerToAir::createGenericCompare):
+ * b3/B3ReduceStrength.cpp:
+
2015-11-05 Aleksandr Skachkov <[email protected]>
Using emitResolveScope & emitGetFromScope with 'this' that is TDZ lead to segfault in DFG
Modified: trunk/Source/_javascript_Core/b3/B3LowerToAir.cpp (192087 => 192088)
--- trunk/Source/_javascript_Core/b3/B3LowerToAir.cpp 2015-11-06 00:06:56 UTC (rev 192087)
+++ trunk/Source/_javascript_Core/b3/B3LowerToAir.cpp 2015-11-06 00:13:57 UTC (rev 192088)
@@ -804,6 +804,10 @@
Value* right = value->child(1);
if (isInt(value->child(0)->type())) {
+ // FIXME: We wouldn't have to worry about leftImm if we canonicalized integer
+ // comparisons.
+ // https://bugs.webkit.org/show_bug.cgi?id=150958
+
Arg leftImm = imm(left);
Arg rightImm = imm(right);
@@ -931,6 +935,9 @@
Value* left = value->child(0);
Value* right = value->child(1);
+ // FIXME: We don't actually have to worry about leftImm.
+ // https://bugs.webkit.org/show_bug.cgi?id=150954
+
Arg leftImm = imm(left);
Arg rightImm = imm(right);
Modified: trunk/Source/_javascript_Core/b3/B3ReduceStrength.cpp (192087 => 192088)
--- trunk/Source/_javascript_Core/b3/B3ReduceStrength.cpp 2015-11-06 00:06:56 UTC (rev 192087)
+++ trunk/Source/_javascript_Core/b3/B3ReduceStrength.cpp 2015-11-06 00:13:57 UTC (rev 192088)
@@ -470,6 +470,9 @@
break;
case LessThan:
+ // FIXME: We could do a better job of canonicalizing integer comparisons.
+ // https://bugs.webkit.org/show_bug.cgi?id=150958
+
replaceWithNewValue(
m_proc.addBoolConstant(m_value->child(0)->lessThanConstant(m_value->child(1))));
break;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
