Changeset 171689 in webkit for trunk/Source/JavaScriptCore/tests

Timestamp:

Jul 28, 2014, 1:41:09 PM (11 years ago)

Author:

[email protected]

Message:

Make sure that we don't use non-speculative BooleanToNumber for a speculative Branch
​https://bugs.webkit.org/show_bug.cgi?id=135350
<rdar://problem/17509889>

Reviewed by Mark Hahnenberg and Oliver Hunt.

If we have an exiting node that uses a conversion node, then that exiting node
needs to have a Phantom after it for the the original node. But we can't do that
for Branch because ​https://bugs.webkit.org/show_bug.cgi?id=126778.

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::clearPhantomsAtEnd):

• tests/stress/branch-check-int32-on-boolean-to-number-untyped.js: Added.

(foo):
(test):

• tests/stress/branch-check-number-on-boolean-to-number-untyped.js: Added.

(foo):
(test):

Location:

trunk/Source/JavaScriptCore/tests/stress

Files:

• branch-check-int32-on-boolean-to-number-untyped.js (added)
• branch-check-number-on-boolean-to-number-untyped.js (added)