Title: [225865] trunk/Source/_javascript_Core
- Revision
- 225865
- Author
- sbar...@apple.com
- Date
- 2017-12-13 12:46:33 -0800 (Wed, 13 Dec 2017)
Log Message
REGRESSION(r225844): Around 850 new JSC failures on 32-bit
https://bugs.webkit.org/show_bug.cgi?id=180764
Unreviewed. We should only emit CheckStructureOrEmpty on 64 bit platforms.
* dfg/DFGTypeCheckHoistingPhase.cpp:
(JSC::DFG::TypeCheckHoistingPhase::run):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (225864 => 225865)
--- trunk/Source/_javascript_Core/ChangeLog 2017-12-13 20:20:18 UTC (rev 225864)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-12-13 20:46:33 UTC (rev 225865)
@@ -1,3 +1,13 @@
+2017-12-13 Saam Barati <sbar...@apple.com>
+
+ REGRESSION(r225844): Around 850 new JSC failures on 32-bit
+ https://bugs.webkit.org/show_bug.cgi?id=180764
+
+ Unreviewed. We should only emit CheckStructureOrEmpty on 64 bit platforms.
+
+ * dfg/DFGTypeCheckHoistingPhase.cpp:
+ (JSC::DFG::TypeCheckHoistingPhase::run):
+
2017-12-13 Michael Saboff <msab...@apple.com>
Unreviewed rollout of r225695. Caused a crash on yahoo login page.
Modified: trunk/Source/_javascript_Core/dfg/DFGTypeCheckHoistingPhase.cpp (225864 => 225865)
--- trunk/Source/_javascript_Core/dfg/DFGTypeCheckHoistingPhase.cpp 2017-12-13 20:20:18 UTC (rev 225864)
+++ trunk/Source/_javascript_Core/dfg/DFGTypeCheckHoistingPhase.cpp 2017-12-13 20:46:33 UTC (rev 225865)
@@ -145,12 +145,15 @@
OpInfo(variable), Edge(node));
if (iter->value.m_structure) {
auto checkOp = CheckStructure;
- VirtualRegister local = node->variableAccessData()->local();
- auto* inlineCallFrame = node->origin.semantic.inlineCallFrame;
- if ((local - (inlineCallFrame ? inlineCallFrame->stackOffset : 0)) == virtualRegisterForArgument(0)) {
- // |this| can be the TDZ value. The call entrypoint won't have |this| as TDZ,
- // but a catch or a loop OSR entry may have |this| be TDZ.
- checkOp = CheckStructureOrEmpty;
+ if (is64Bit()) {
+ static_assert(is64Bit() || !(SpecCellCheck & SpecEmpty), "");
+ VirtualRegister local = node->variableAccessData()->local();
+ auto* inlineCallFrame = node->origin.semantic.inlineCallFrame;
+ if ((local - (inlineCallFrame ? inlineCallFrame->stackOffset : 0)) == virtualRegisterForArgument(0)) {
+ // |this| can be the TDZ value. The call entrypoint won't have |this| as TDZ,
+ // but a catch or a loop OSR entry may have |this| be TDZ.
+ checkOp = CheckStructureOrEmpty;
+ }
}
insertionSet.insertNode(
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
