Changeset 165098 in webkit for trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

Timestamp:

Mar 4, 2014, 11:25:02 PM (11 years ago)

Author:

[email protected]

Message:

Unreviewed, rolling out r165085.
​http://trac.webkit.org/changeset/165085
​https://bugs.webkit.org/show_bug.cgi?id=129729

Broke imported/w3c/html-templates/template-element/template-
content.html (Requested by ap on #webkit).

Source/JavaScriptCore:

• bytecode/SpeculatedType.cpp:

(JSC::speculationToAbbreviatedString):

• bytecode/SpeculatedType.h:
• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::refine):

• dfg/DFGArrayMode.h:
• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::attemptToMakeGetArrayLength):

• dfg/DFGNode.h:

(JSC::DFG::Node::shouldSpeculateBoolean):

• dfg/DFGSafeToExecute.h:

(JSC::DFG::SafeToExecuteEdge::operator()):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileStrictEq):
(JSC::DFG::SpeculativeJIT::speculate):

• dfg/DFGSpeculativeJIT.h:
• dfg/DFGSpeculativeJIT32_64.cpp:
• dfg/DFGSpeculativeJIT64.cpp:
• dfg/DFGUseKind.cpp:

(WTF::printInternal):

• dfg/DFGUseKind.h:

(JSC::DFG::typeFilterFor):

• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compileCompareEq):
(JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
(JSC::FTL::LowerDFGToLLVM::speculate):

• tests/stress/float32-array-out-of-bounds.js: Removed.
• tests/stress/weird-equality-folding-cases.js: Removed.

LayoutTests:

• js/regress/fold-strict-eq-expected.txt: Removed.
• js/regress/fold-strict-eq.html: Removed.
• js/regress/misc-strict-eq-expected.txt: Removed.
• js/regress/misc-strict-eq.html: Removed.
• js/regress/script-tests/fold-strict-eq.js: Removed.
• js/regress/script-tests/misc-strict-eq.js: Removed.

File:

• trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

@@ -918 +918 @@
             SpeculatedType leftType = forNode(node->child1()).m_type;
             SpeculatedType rightType = forNode(node->child2()).m_type;
-            if (!valuesCouldBeEqual(leftType, rightType)) {
+            if ((isInt32Speculation(leftType) && isOtherSpeculation(rightType))
+                || (isOtherSpeculation(leftType) && isInt32Speculation(rightType))) {
                 setConstant(node, jsBoolean(false));
                 break;
@@ -943 +944 @@
         JSValue right = forNode(rightNode).value();
         if (left && right) {
+            if (left.isNumber() && right.isNumber()) {
+                setConstant(node, jsBoolean(left.asNumber() == right.asNumber()));
+                break;
+            }
             if (left.isString() && right.isString()) {
-                // We need this case because JSValue::strictEqual is otherwise too racy for
-                // string comparisons.
                 const StringImpl* a = asString(left)->tryGetValueImpl();
                 const StringImpl* b = asString(right)->tryGetValueImpl();
@@ -952 +955 @@
                     break;
                 }
-            } else {
-                setConstant(node, jsBoolean(JSValue::strictEqual(0, left, right)));
-                break;
-            }
-        }
-        
-        SpeculatedType leftLUB = leastUpperBoundOfStrictlyEquivalentSpeculations(forNode(leftNode).m_type);
-        SpeculatedType rightLUB = leastUpperBoundOfStrictlyEquivalentSpeculations(forNode(rightNode).m_type);
-        if (!(leftLUB & rightLUB)) {
-            setConstant(node, jsBoolean(false));
-            break;
-        }
-        
+            }
+        }
         forNode(node).setType(SpecBoolean);
         node->setCanExit(true); // This is overly conservative.