Modified: trunk/JSTests/ChangeLog (264321 => 264322)
--- trunk/JSTests/ChangeLog 2020-07-13 22:31:53 UTC (rev 264321)
+++ trunk/JSTests/ChangeLog 2020-07-13 22:36:01 UTC (rev 264322)
@@ -1,3 +1,14 @@
+2020-07-13 Yusuke Suzuki <[email protected]>
+
+ [JSC] FTL isCellOrMisc should be isCellOrMiscOrBigInt32
+ https://bugs.webkit.org/show_bug.cgi?id=214269
+ <rdar://problem/65475129>
+
+ Reviewed by Mark Lam.
+
+ * stress/ftl-bigint32-and-cell-or-misc.js: Added.
+ (foo):
+
2020-07-13 Keith Miller <[email protected]>
Clean up SourceProvider and add caller relative load script to jsc.cpp
Added: trunk/JSTests/stress/ftl-bigint32-and-cell-or-misc.js (0 => 264322)
--- trunk/JSTests/stress/ftl-bigint32-and-cell-or-misc.js (rev 0)
+++ trunk/JSTests/stress/ftl-bigint32-and-cell-or-misc.js 2020-07-13 22:36:01 UTC (rev 264322)
@@ -0,0 +1,14 @@
+//@ runDefault("--jitPolicyScale=0", "--useConcurrentJIT=0")
+
+[].__proto__.x = undefined;
+
+function foo() {
+ for (const q in [0]) {
+ const m1 = ~(0n>>0n);
+ for (let i=0; i<2; i++) {}
+ let m2 = m1;
+ }
+}
+for (let i=0; i<100; i++) {
+ foo();
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (264321 => 264322)
--- trunk/Source/_javascript_Core/ChangeLog 2020-07-13 22:31:53 UTC (rev 264321)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-07-13 22:36:01 UTC (rev 264322)
@@ -1,3 +1,26 @@
+2020-07-13 Yusuke Suzuki <[email protected]>
+
+ [JSC] FTL isCellOrMisc should be isCellOrMiscOrBigInt32
+ https://bugs.webkit.org/show_bug.cgi?id=214269
+ <rdar://problem/65475129>
+
+ Reviewed by Mark Lam.
+
+ FTL isCellOrMisc's check can accept BigInt32 too. So it should be isCellOrMiscOrBigInt32.
+ Since our proven type filter does not include SpecBigInt32, isCellOrMisc can be folded into
+ false for BigInt32 AbstractValue. This patch fixes that filter. And we also reviewed places
+ using isCellOrMisc / isNotCellOrMisc.
+
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileSwitch):
+ (JSC::FTL::DFG::LowerDFGToB3::numberOrNotCellNorBigIntToInt32):
+ (JSC::FTL::DFG::LowerDFGToB3::isCellOrMiscOrBigInt32):
+ (JSC::FTL::DFG::LowerDFGToB3::isNotCellOrMiscOrBigInt32):
+ (JSC::FTL::DFG::LowerDFGToB3::isNumber):
+ (JSC::FTL::DFG::LowerDFGToB3::isNotNumber):
+ (JSC::FTL::DFG::LowerDFGToB3::isCellOrMisc): Deleted.
+ (JSC::FTL::DFG::LowerDFGToB3::isNotCellOrMisc): Deleted.
+
2020-07-13 Geoffrey Garen <[email protected]>
Unreviewed, re-landing r264242 with crash fixed.
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (264321 => 264322)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2020-07-13 22:31:53 UTC (rev 264321)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2020-07-13 22:36:01 UTC (rev 264322)
@@ -10655,7 +10655,7 @@
m_out.appendTo(isNotInt, isDouble);
m_out.branch(
- isCellOrMisc(boxedValue, provenType(m_node->child1())),
+ isCellOrMiscOrBigInt32(boxedValue, provenType(m_node->child1())),
usually(lowBlock(data->fallThrough.block)), rarely(isDouble));
m_out.appendTo(isDouble, innerLastNext);
@@ -13318,13 +13318,12 @@
if (edge.useKind() == NumberUse) {
m_out.appendTo(notIntCase, continuation);
- FTL_TYPE_CHECK(jsValueValue(value), edge, SpecBytecodeNumber, isCellOrMisc(value));
+ FTL_TYPE_CHECK(jsValueValue(value), edge, SpecBytecodeNumber, isCellOrMiscOrBigInt32(value));
results.append(m_out.anchor(doubleToInt32(unboxDouble(value))));
m_out.jump(continuation);
} else {
m_out.appendTo(notIntCase, doubleCase);
- m_out.branch(
- isCellOrMisc(value, provenType(edge)), unsure(notNumberCase), unsure(doubleCase));
+ m_out.branch(isCellOrMiscOrBigInt32(value, provenType(edge)), unsure(notNumberCase), unsure(doubleCase));
m_out.appendTo(doubleCase, notNumberCase);
results.append(m_out.anchor(doubleToInt32(unboxDouble(value))));
@@ -17453,15 +17452,23 @@
}
#endif // USE(BIGINT32)
- LValue isCellOrMisc(LValue jsValue, SpeculatedType type = SpecFullTop)
+ LValue isCellOrMiscOrBigInt32(LValue jsValue, SpeculatedType type = SpecFullTop)
{
- if (LValue proven = isProvenValue(type, SpecCellCheck | SpecMisc))
+ SpeculatedType filter = SpecCellCheck | SpecMisc;
+#if USE(BIGINT32)
+ filter |= SpecBigInt32;
+#endif // USE(BIGINT32)
+ if (LValue proven = isProvenValue(type, filter))
return proven;
return m_out.testIsZero64(jsValue, m_numberTag);
}
- LValue isNotCellOrMisc(LValue jsValue, SpeculatedType type = SpecFullTop)
+ LValue isNotCellOrMiscOrBigInt32(LValue jsValue, SpeculatedType type = SpecFullTop)
{
- if (LValue proven = isProvenValue(type, ~(SpecCellCheck | SpecMisc)))
+ SpeculatedType filter = SpecCellCheck | SpecMisc;
+#if USE(BIGINT32)
+ filter |= SpecBigInt32;
+#endif // USE(BIGINT32)
+ if (LValue proven = isProvenValue(type, ~filter))
return proven;
return m_out.testNonZero64(jsValue, m_numberTag);
}
@@ -17570,13 +17577,13 @@
{
if (LValue proven = isProvenValue(type, SpecFullNumber))
return proven;
- return isNotCellOrMisc(jsValue);
+ return isNotCellOrMiscOrBigInt32(jsValue);
}
LValue isNotNumber(LValue jsValue, SpeculatedType type = SpecFullTop)
{
if (LValue proven = isProvenValue(type, ~SpecFullNumber))
return proven;
- return isCellOrMisc(jsValue);
+ return isCellOrMiscOrBigInt32(jsValue);
}
LValue isNotCell(LValue jsValue, SpeculatedType type = SpecFullTop)
