Changeset 209678 in webkit for trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

Timestamp:

Dec 10, 2016, 5:14:37 PM (9 years ago)

Author:

[email protected]

Message:

Unreviewed, rolling out r209653, r209654, r209663, and
r209673.
​https://bugs.webkit.org/show_bug.cgi?id=165739

speedometer crashes (Requested by pizlo on #webkit).

Reverted changesets:

"JSVALUE64: Pass arguments in platform argument registers when
making JavaScript calls"
​https://bugs.webkit.org/show_bug.cgi?id=160355
​http://trac.webkit.org/changeset/209653

"Unreviewed build fix for 32 bit builds."
​http://trac.webkit.org/changeset/209654

"Unreviewed build fix for the CLOOP after r209653"
​http://trac.webkit.org/changeset/209663

"REGRESSION(r209653) Crash in CallFrameShuffler::snapshot()"
​https://bugs.webkit.org/show_bug.cgi?id=165728
​http://trac.webkit.org/changeset/209673

File:

• trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

@@ -169 +169 @@
         }
 
-        case GetArgumentRegister: {
-            VariableAccessData* variable = node->variableAccessData();
-            SpeculatedType prediction = variable->prediction();
-            if (!variable->couldRepresentInt52() && (prediction & SpecInt52Only))
-                prediction = (prediction | SpecAnyIntAsDouble) & ~SpecInt52Only;
-            if (prediction)
-                changed |= mergePrediction(prediction);
-            break;
-        }
-            
         case UInt32ToNumber: {
             if (node->canSpeculateInt32(m_pass))
@@ -979 +969 @@
         case GetLocal:
         case SetLocal:
-        case GetArgumentRegister:
         case UInt32ToNumber:
         case ValueAdd: