Title: [212909] trunk/Source/_javascript_Core
- Revision
- 212909
- Author
- fpi...@apple.com
- Date
- 2017-02-23 11:47:32 -0800 (Thu, 23 Feb 2017)
Log Message
SpeculativeJIT::compilePutByValForIntTypedArray should only do the constant-folding optimization when the constant passes the type check
https://bugs.webkit.org/show_bug.cgi?id=168787
Reviewed by Michael Saboff and Mark Lam.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (212908 => 212909)
--- trunk/Source/_javascript_Core/ChangeLog 2017-02-23 19:42:58 UTC (rev 212908)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-02-23 19:47:32 UTC (rev 212909)
@@ -1,3 +1,13 @@
+2017-02-23 Filip Pizlo <fpi...@apple.com>
+
+ SpeculativeJIT::compilePutByValForIntTypedArray should only do the constant-folding optimization when the constant passes the type check
+ https://bugs.webkit.org/show_bug.cgi?id=168787
+
+ Reviewed by Michael Saboff and Mark Lam.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+
2017-02-23 Mark Lam <mark....@apple.com>
Ensure that the end of the last invalidation point does not extend beyond the end of the buffer.
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (212908 => 212909)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2017-02-23 19:42:58 UTC (rev 212908)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2017-02-23 19:47:32 UTC (rev 212909)
@@ -2812,9 +2812,17 @@
#endif
JITCompiler::JumpList slowPathCases;
-
+
+ bool isAppropriateConstant = false;
if (valueUse->isConstant()) {
JSValue jsValue = valueUse->asJSValue();
+ SpeculatedType expectedType = typeFilterFor(valueUse.useKind());
+ SpeculatedType actualType = speculationFromValue(jsValue);
+ isAppropriateConstant = (expectedType | actualType) == expectedType;
+ }
+
+ if (isAppropriateConstant) {
+ JSValue jsValue = valueUse->asJSValue();
if (!jsValue.isNumber()) {
terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
noResult(node);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
