Changeset 155567 in webkit for trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h

Timestamp:

Sep 11, 2013, 2:49:47 PM (12 years ago)

Author:

[email protected]

Message:

Int32ToDouble should be predicted SpecInt48 and predictions should have nothing to do with constant folding
​https://bugs.webkit.org/show_bug.cgi?id=121141

Source/JavaScriptCore:

Reviewed by Oliver Hunt.

Just changing Int32ToDouble to be predicted SpecInt48 breaks constant folding on that
node because of soooper old code that prevented constant folding on mismatched
predictions. Kill that code.

• dfg/DFGAbstractInterpreter.h:

(JSC::DFG::AbstractInterpreter::setConstant):

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::::executeEffects):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::injectInt32ToDoubleNode):

LayoutTests:

Reviewed by Oliver Hunt.

Fixing this means that this test no longer recompiles.

• js/script-tests/dfg-constant-fold-misprediction.js:

File:

• trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h

@@ -160 +160 @@
     BooleanResult booleanResult(Node*, AbstractValue&);
     
-    bool trySetConstant(Node* node, JSValue value)
+    void setConstant(Node* node, JSValue value)
     {
-        // Make sure we don't constant fold something that will produce values that contravene
-        // predictions. If that happens then we know that the code will OSR exit, forcing
-        // recompilation. But if we tried to constant fold then we'll have a very degenerate
-        // IR: namely we'll have a JSConstant that contravenes its own prediction. There's a
-        // lot of subtle code that assumes that
-        // speculationFromValue(jsConstant) == jsConstant.prediction(). "Hardening" that code
-        // is probably less sane than just pulling back on constant folding.
-        SpeculatedType oldType = node->prediction();
-        if (mergeSpeculations(speculationFromValue(value), oldType) != oldType)
-            return false;
-        
         forNode(node).set(m_graph, value);
-        return true;
+        m_state.setFoundConstants(true);
     }