Diff
Modified: branches/safari-537.73-branch/LayoutTests/ChangeLog (157764 => 157765)
--- branches/safari-537.73-branch/LayoutTests/ChangeLog 2013-10-21 23:54:20 UTC (rev 157764)
+++ branches/safari-537.73-branch/LayoutTests/ChangeLog 2013-10-21 23:55:17 UTC (rev 157765)
@@ -1,5 +1,22 @@
2013-10-21 Lucas Forschler <lforsch...@apple.com>
+ Merge r154217
+
+ 2013-08-16 Filip Pizlo <fpi...@apple.com>
+
+ DFG optimizes out strict mode arguments tear off
+ https://bugs.webkit.org/show_bug.cgi?id=119504
+
+ Reviewed by Mark Hahnenberg and Oliver Hunt.
+
+ * fast/js/dfg-arguments-strict-mode-expected.txt: Added.
+ * fast/js/dfg-arguments-strict-mode.html: Added.
+ * fast/js/jsc-test-list:
+ * fast/js/script-tests/dfg-arguments-strict-mode.js: Added.
+ (f):
+
+2013-10-21 Lucas Forschler <lforsch...@apple.com>
+
Merge r153982
2013-08-12 Ryosuke Niwa <rn...@webkit.org>
Copied: branches/safari-537.73-branch/LayoutTests/fast/js/dfg-arguments-strict-mode-expected.txt (from rev 154217, trunk/LayoutTests/fast/js/dfg-arguments-strict-mode-expected.txt) (0 => 157765)
--- branches/safari-537.73-branch/LayoutTests/fast/js/dfg-arguments-strict-mode-expected.txt (rev 0)
+++ branches/safari-537.73-branch/LayoutTests/fast/js/dfg-arguments-strict-mode-expected.txt 2013-10-21 23:55:17 UTC (rev 157765)
@@ -0,0 +1,10 @@
+Tests what happens when you use arguments in strict mode and present the DFG with a tempting optimization opportunity.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS f(1) is 1
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/safari-537.73-branch/LayoutTests/fast/js/dfg-arguments-strict-mode.html (from rev 154217, trunk/LayoutTests/fast/js/dfg-arguments-strict-mode.html) (0 => 157765)
--- branches/safari-537.73-branch/LayoutTests/fast/js/dfg-arguments-strict-mode.html (rev 0)
+++ branches/safari-537.73-branch/LayoutTests/fast/js/dfg-arguments-strict-mode.html 2013-10-21 23:55:17 UTC (rev 157765)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Modified: branches/safari-537.73-branch/LayoutTests/fast/js/jsc-test-list (157764 => 157765)
--- branches/safari-537.73-branch/LayoutTests/fast/js/jsc-test-list 2013-10-21 23:54:20 UTC (rev 157764)
+++ branches/safari-537.73-branch/LayoutTests/fast/js/jsc-test-list 2013-10-21 23:55:17 UTC (rev 157765)
@@ -86,6 +86,7 @@
fast/js/dfg-arguments-osr-exit-multiple-blocks
fast/js/dfg-arguments-osr-exit-multiple-blocks-before-exit
fast/js/dfg-arguments-out-of-bounds
+fast/js/dfg-arguments-strict-mode
fast/js/dfg-arguments-unexpected-escape
fast/js/dfg-arith-add-overflow-check-elimination-predicted-but-not-proven-int
fast/js/dfg-arith-add-overflow-check-elimination-tower-of-large-numbers
Copied: branches/safari-537.73-branch/LayoutTests/fast/js/script-tests/dfg-arguments-strict-mode.js (from rev 154217, trunk/LayoutTests/fast/js/script-tests/dfg-arguments-strict-mode.js) (0 => 157765)
--- branches/safari-537.73-branch/LayoutTests/fast/js/script-tests/dfg-arguments-strict-mode.js (rev 0)
+++ branches/safari-537.73-branch/LayoutTests/fast/js/script-tests/dfg-arguments-strict-mode.js 2013-10-21 23:55:17 UTC (rev 157765)
@@ -0,0 +1,17 @@
+description(
+"Tests what happens when you use arguments in strict mode and present the DFG with a tempting optimization opportunity."
+);
+
+function f(a) {
+ "use strict";
+ a = 5;
+ return arguments[0];
+}
+
+noInline(f);
+
+while (!dfgCompiled({f:f}))
+ f(1);
+
+shouldBe("f(1)", "1");
+
Modified: branches/safari-537.73-branch/Source/_javascript_Core/ChangeLog (157764 => 157765)
--- branches/safari-537.73-branch/Source/_javascript_Core/ChangeLog 2013-10-21 23:54:20 UTC (rev 157764)
+++ branches/safari-537.73-branch/Source/_javascript_Core/ChangeLog 2013-10-21 23:55:17 UTC (rev 157765)
@@ -1,3 +1,20 @@
+2013-10-21 Lucas Forschler <lforsch...@apple.com>
+
+ Merge r154217
+
+ 2013-08-16 Filip Pizlo <fpi...@apple.com>
+
+ DFG optimizes out strict mode arguments tear off
+ https://bugs.webkit.org/show_bug.cgi?id=119504
+
+ Reviewed by Mark Hahnenberg and Oliver Hunt.
+
+ Don't do the optimization for strict mode.
+
+ * dfg/DFGArgumentsSimplificationPhase.cpp:
+ (JSC::DFG::ArgumentsSimplificationPhase::run):
+ (JSC::DFG::ArgumentsSimplificationPhase::pruneObviousArgumentCreations):
+
2013-09-04 Dean Jackson <d...@apple.com>
<rdar://problem/14910916> Disable CSS_SHAPES on safari-537-branch
Modified: branches/safari-537.73-branch/Source/_javascript_Core/dfg/DFGArgumentsSimplificationPhase.cpp (157764 => 157765)
--- branches/safari-537.73-branch/Source/_javascript_Core/dfg/DFGArgumentsSimplificationPhase.cpp 2013-10-21 23:54:20 UTC (rev 157764)
+++ branches/safari-537.73-branch/Source/_javascript_Core/dfg/DFGArgumentsSimplificationPhase.cpp 2013-10-21 23:55:17 UTC (rev 157765)
@@ -123,12 +123,9 @@
bool changed = false;
// Record which arguments are known to escape no matter what.
- for (unsigned i = codeBlock()->inlineCallFrames().size(); i--;) {
- InlineCallFrame* inlineCallFrame = &codeBlock()->inlineCallFrames()[i];
- if (m_graph.m_executablesWhoseArgumentsEscaped.contains(
- m_graph.executableFor(inlineCallFrame)))
- m_createsArguments.add(inlineCallFrame);
- }
+ for (unsigned i = codeBlock()->inlineCallFrames().size(); i--;)
+ pruneObviousArgumentCreations(&codeBlock()->inlineCallFrames()[i]);
+ pruneObviousArgumentCreations(0); // the machine call frame.
// Create data for variable access datas that we will want to analyze.
for (unsigned i = m_graph.m_variableAccessData.size(); i--;) {
@@ -700,6 +697,14 @@
NullableHashTraits<VariableAccessData*> > m_argumentsAliasing;
HashSet<VariableAccessData*> m_isLive;
+ void pruneObviousArgumentCreations(InlineCallFrame* inlineCallFrame)
+ {
+ ScriptExecutable* executable = jsCast<ScriptExecutable*>(m_graph.executableFor(inlineCallFrame));
+ if (m_graph.m_executablesWhoseArgumentsEscaped.contains(executable)
+ || executable->isStrictMode())
+ m_createsArguments.add(inlineCallFrame);
+ }
+
void observeBadArgumentsUse(Node* node)
{
if (!node)
