Changeset 165098 in webkit for trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

Timestamp:

Mar 4, 2014, 11:25:02 PM (11 years ago)

Author:

[email protected]

Message:

Unreviewed, rolling out r165085.
​http://trac.webkit.org/changeset/165085
​https://bugs.webkit.org/show_bug.cgi?id=129729

Broke imported/w3c/html-templates/template-element/template-
content.html (Requested by ap on #webkit).

Source/JavaScriptCore:

• bytecode/SpeculatedType.cpp:

(JSC::speculationToAbbreviatedString):

• bytecode/SpeculatedType.h:
• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::refine):

• dfg/DFGArrayMode.h:
• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::attemptToMakeGetArrayLength):

• dfg/DFGNode.h:

(JSC::DFG::Node::shouldSpeculateBoolean):

• dfg/DFGSafeToExecute.h:

(JSC::DFG::SafeToExecuteEdge::operator()):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileStrictEq):
(JSC::DFG::SpeculativeJIT::speculate):

• dfg/DFGSpeculativeJIT.h:
• dfg/DFGSpeculativeJIT32_64.cpp:
• dfg/DFGSpeculativeJIT64.cpp:
• dfg/DFGUseKind.cpp:

(WTF::printInternal):

• dfg/DFGUseKind.h:

(JSC::DFG::typeFilterFor):

• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compileCompareEq):
(JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
(JSC::FTL::LowerDFGToLLVM::speculate):

• tests/stress/float32-array-out-of-bounds.js: Removed.
• tests/stress/weird-equality-folding-cases.js: Removed.

LayoutTests:

• js/regress/fold-strict-eq-expected.txt: Removed.
• js/regress/fold-strict-eq.html: Removed.
• js/regress/misc-strict-eq-expected.txt: Removed.
• js/regress/misc-strict-eq.html: Removed.
• js/regress/script-tests/fold-strict-eq.js: Removed.
• js/regress/script-tests/misc-strict-eq.js: Removed.

File:

• trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (modified) (5 diffs)

trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

@@ -433 +433 @@
                 break;
             }
-            if (node->child1()->shouldSpeculateMisc() && node->child2()->shouldSpeculateMisc()) {
-                fixEdge<MiscUse>(node->child1());
-                fixEdge<MiscUse>(node->child2());
-                break;
-            }
             break;
         }
@@ -458 +453 @@
             node->setArrayMode(
                 node->arrayMode().refine(
-                    m_graph, node,
+                    m_graph, node->origin.semantic,
                     node->child1()->prediction(),
                     node->child2()->prediction(),
@@ -516 +511 @@
             node->setArrayMode(
                 node->arrayMode().refine(
-                    m_graph, node,
+                    m_graph, node->origin.semantic,
                     child1->prediction(),
                     child2->prediction(),
@@ -602 +597 @@
             node->setArrayMode(
                 node->arrayMode().refine(
-                    m_graph, node,
+                    m_graph, node->origin.semantic,
                     node->child1()->prediction() & SpecCell,
                     SpecInt32,
@@ -1756 +1751 @@
             
         arrayMode = arrayMode.refine(
-            m_graph, node, node->child1()->prediction(), node->prediction());
+            m_graph, node->origin.semantic, node->child1()->prediction(), node->prediction());
             
         if (arrayMode.type() == Array::Generic) {