Changeset 193782 in webkit for trunk/Source/JavaScriptCore/dfg/DFGUnificationPhase.cpp

Timestamp:

Dec 8, 2015, 1:45:54 PM (9 years ago)

Author:

[email protected]

Message:

DFG::UnificationPhase should merge isProfitableToUnbox, since this may have been set in ByteCodeParser
​https://bugs.webkit.org/show_bug.cgi?id=152011
rdar://problem/23777875

Reviewed by Michael Saboff.

Previously UnificationPhase did not merge this because we used to only set this in FixupPhase, which runs after unification. But now
ByteCodeParser may set isProfitableToUnbox as part of how it handles the ArgumentCount of an inlined varargs call, so UnificationPhase
needs to merge it after unifying.

Also changed the order of unification since this makes the bug more obvious and easier to test.

• dfg/DFGUnificationPhase.cpp:

(JSC::DFG::UnificationPhase::run):

• tests/stress/varargs-with-unused-count.js: Added.

File:

• trunk/Source/JavaScriptCore/dfg/DFGUnificationPhase.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGUnificationPhase.cpp

@@ -61 +61 @@
                         break;
                     
-                    phi->variableAccessData()->unify(
-                        phi->children.child(childIdx)->variableAccessData());
+                    phi->children.child(childIdx)->variableAccessData()->unify(phi->variableAccessData());
                 }
             }
@@ -75 +74 @@
             data->find()->mergeShouldNeverUnbox(data->shouldNeverUnbox());
             data->find()->mergeIsLoadedFrom(data->isLoadedFrom());
+            data->find()->mergeIsProfitableToUnbox(data->isProfitableToUnbox());
         }