Changeset 198979 in webkit for trunk/Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp

Timestamp:

Apr 2, 2016, 6:55:26 PM (9 years ago)

Author:

[email protected]

Message:

Unreviewed, rolling out r198976.
​https://bugs.webkit.org/show_bug.cgi?id=156140

"Causes js/regress/array-nonarray-polymorhpic-access.html to
crash." (Requested by ddkilzer on #webkit).

Reverted changeset:

"[JSC] Initialize SSA's live values at tail lazily"
​https://bugs.webkit.org/show_bug.cgi?id=156126
​http://trac.webkit.org/changeset/198976

File:

• trunk/Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp

@@ -75 +75 @@
 }
 
+static void setLiveValues(HashMap<Node*, AbstractValue>& values, HashSet<Node*>& live)
+{
+    values.clear();
+    
+    HashSet<Node*>::iterator iter = live.begin();
+    HashSet<Node*>::iterator end = live.end();
+    for (; iter != end; ++iter)
+        values.add(*iter, AbstractValue());
+}
+
 static void setLiveValues(Vector<BasicBlock::SSAData::NodeAbstractValuePair>& values, HashSet<Node*>& live)
 {
@@ -154 +164 @@
                 continue;
             setLiveValues(block->ssa->valuesAtHead, block->ssa->liveAtHead);
+            setLiveValues(block->ssa->valuesAtTail, block->ssa->liveAtTail);
         }
     }
@@ -193 +204 @@
             changed |= block->valuesAtTail[i].merge(m_variables[i]);
 
-        for (Node* node : block->ssa->liveAtTail) {
-            auto iterator = block->ssa->valuesAtTail.add(node, AbstractValue()).iterator;
-            changed |= iterator->value.merge(forNode(node));
+        HashSet<Node*>::iterator iter = block->ssa->liveAtTail.begin();
+        HashSet<Node*>::iterator end = block->ssa->liveAtTail.end();
+        for (; iter != end; ++iter) {
+            Node* node = *iter;
+            changed |= block->ssa->valuesAtTail.find(node)->value.merge(forNode(node));
         }
         break;