Changeset 132554 in webkit for trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp

Timestamp:

Oct 25, 2012, 6:57:07 PM (13 years ago)

Author:

[email protected]

Message:

DFG Arrayify elimination should replace it with GetButterfly rather than Phantom
​https://bugs.webkit.org/show_bug.cgi?id=100441

Reviewed by Oliver Hunt and Gavin Barraclough.

Source/JavaScriptCore:

Made array profiler's to-string helper behave correctly.

Made Arrayify elimination do the right thing (convert to GetButterfly).

Made CFA's interference analysis track clobbered array modes correctly, mostly by
simplifying the machinery.

• bytecode/ArrayProfile.cpp:

(JSC::arrayModesToString):

• dfg/DFGAbstractState.cpp:

(JSC::DFG::AbstractState::execute):

• dfg/DFGAbstractValue.h:

(JSC::DFG::AbstractValue::clobberArrayModes):
(AbstractValue):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

LayoutTests:

• fast/js/dfg-arrayify-elimination-expected.txt: Added.
• fast/js/dfg-arrayify-elimination.html: Added.
• fast/js/jsc-test-list:
• fast/js/script-tests/dfg-arrayify-elimination.js: Added.

(foo):

File:

• trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp

@@ -103 +103 @@
             }
                 
-            case CheckArray:
-            case Arrayify: {
+            case CheckArray: {
                 if (!modeAlreadyChecked(m_state.forNode(node.child1()), node.arrayMode()))
                     break;
@@ -113 +112 @@
             }
                 
+            case Arrayify: {
+                if (!modeAlreadyChecked(m_state.forNode(node.child1()), node.arrayMode()))
+                    break;
+                ASSERT(node.refCount() >= 1);
+                node.setOpAndDefaultFlags(GetButterfly);
+                m_graph.deref(nodeIndex);
+                eliminated = true;
+                break;
+            }
+
             default:
                 break;