Diff
Modified: trunk/LayoutTests/ChangeLog (98516 => 98517)
--- trunk/LayoutTests/ChangeLog 2011-10-26 21:09:04 UTC (rev 98516)
+++ trunk/LayoutTests/ChangeLog 2011-10-26 21:13:52 UTC (rev 98517)
@@ -1,3 +1,15 @@
+2011-10-26 Filip Pizlo <fpi...@apple.com>
+
+ REGRESSION (r97030): Cannot log in to progressive.com
+ https://bugs.webkit.org/show_bug.cgi?id=70094
+
+ Reviewed by Oliver Hunt.
+
+ * fast/js/dfg-intrinsic-osr-exit-expected.html: Added.
+ * fast/js/dfg-intrinsic-osr-exit.html: Added.
+ * fast/js/script-tests/dfg-intrinsic-osr-exit.js: Added.
+ (foo):
+
2011-10-26 Leandro Pereira <lean...@profusion.mobi>
[EFL] Unreviewed. Add pixel baselines for CSS3 tests.
Added: trunk/LayoutTests/fast/js/dfg-intrinsic-osr-exit-expected.html (0 => 98517)
--- trunk/LayoutTests/fast/js/dfg-intrinsic-osr-exit-expected.html (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-intrinsic-osr-exit-expected.html 2011-10-26 21:13:52 UTC (rev 98517)
@@ -0,0 +1,20 @@
+This tests that an OSR exit inside of an intrinsic that was not loaded with a method check works correctly.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS foo([Math.abs], {f:5}) is 5
+PASS foo([Math.abs], {f:5.5}) is 5.5
+PASS foo([Math.abs], {f:5.5}) is 5.5
+PASS foo([Math.abs], {f:5.5}) is 5.5
+PASS foo([Math.abs], {f:5.5}) is 5.5
+PASS foo([Math.abs], {f:5.5}) is 5.5
+PASS foo([Math.abs], {f:5.5}) is 5.5
+PASS foo([Math.abs], {f:5.5}) is 5.5
+PASS foo([Math.abs], {f:5.5}) is 5.5
+PASS foo([Math.abs], {f:5.5}) is 5.5
+PASS foo([Math.abs], {f:5.5}) is 5.5
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/js/dfg-intrinsic-osr-exit.html (0 => 98517)
--- trunk/LayoutTests/fast/js/dfg-intrinsic-osr-exit.html (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-intrinsic-osr-exit.html 2011-10-26 21:13:52 UTC (rev 98517)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/fast/js/script-tests/dfg-intrinsic-osr-exit.js (0 => 98517)
--- trunk/LayoutTests/fast/js/script-tests/dfg-intrinsic-osr-exit.js (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/dfg-intrinsic-osr-exit.js 2011-10-26 21:13:52 UTC (rev 98517)
@@ -0,0 +1,17 @@
+description(
+"This tests that an OSR exit inside of an intrinsic that was not loaded with a method check works correctly."
+);
+
+function foo(a,b) {
+ return a[0](b.f);
+}
+
+for (var i = 0; i < 100; ++i)
+ foo([Math.abs], {f:5});
+
+shouldBe("foo([Math.abs], {f:5})", "5");
+
+for (var i = 0; i < 10; ++i)
+ shouldBe("foo([Math.abs], {f:5.5})", "5.5");
+
+var successfullyParsed = true;
Modified: trunk/Source/_javascript_Core/ChangeLog (98516 => 98517)
--- trunk/Source/_javascript_Core/ChangeLog 2011-10-26 21:09:04 UTC (rev 98516)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-10-26 21:13:52 UTC (rev 98517)
@@ -1,3 +1,13 @@
+2011-10-26 Filip Pizlo <fpi...@apple.com>
+
+ REGRESSION (r97030): Cannot log in to progressive.com
+ https://bugs.webkit.org/show_bug.cgi?id=70094
+
+ Reviewed by Oliver Hunt.
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::handleCall):
+
2011-10-26 Mark Hahnenberg <mhahnenb...@apple.com>
Remove getOwnPropertySlotVirtual
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (98516 => 98517)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2011-10-26 21:09:04 UTC (rev 98516)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2011-10-26 21:13:52 UTC (rev 98517)
@@ -891,9 +891,17 @@
if (intrinsic != NoIntrinsic) {
if (!certainAboutExpectedFunction)
addToGraph(CheckFunction, OpInfo(expectedFunction), callTarget);
-
- if (handleIntrinsic(usesResult, resultOperand, intrinsic, firstArg, lastArg, prediction))
+
+ if (handleIntrinsic(usesResult, resultOperand, intrinsic, firstArg, lastArg, prediction)) {
+ if (!certainAboutExpectedFunction) {
+ // Need to keep the call target alive for OSR. We could easily optimize this out if we wanted
+ // to, since at this point we know that the call target is a constant. It's just that OSR isn't
+ // smart enough to figure that out, since it doesn't understand CheckFunction.
+ addToGraph(Phantom, callTarget);
+ }
+
return;
+ }
} else if (handleInlining(usesResult, currentInstruction[1].u.operand, callTarget, resultOperand, certainAboutExpectedFunction, expectedFunction, firstArg, lastArg, nextOffset, kind))
return;
}
