Changeset 192949 in webkit for trunk/Source/JavaScriptCore/dfg/DFGClobberize.h

Timestamp:

Dec 2, 2015, 11:15:33 AM (10 years ago)

Author:

[email protected]

Message:

Teach DFG that ArithSub can now clobber the heap (and other things).
​https://bugs.webkit.org/show_bug.cgi?id=151733

Reviewed by Geoffrey Garen.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

File:

• trunk/Source/JavaScriptCore/dfg/DFGClobberize.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGClobberize.h

@@ -248 +248 @@
 
     case ArithAdd:
-    case ArithSub:
     case ArithNegate:
     case ArithMul:
@@ -257 +256 @@
         def(PureValue(node, node->arithMode()));
         return;
+
+    case ArithSub:
+        switch (node->binaryUseKind()) {
+        case Int32Use:
+#if USE(JSVALUE64)
+        case Int52RepUse:
+#endif
+        case DoubleRepUse:
+            def(PureValue(node, node->arithMode()));
+            return;
+        case UntypedUse:
+            read(World);
+            write(Heap);
+            return;
+        default:
+            DFG_CRASH(graph, node, "Bad use kind");
+        }
 
     case ArithRound: