Commit dbeeff35 authored by fpizlo@apple.com's avatar fpizlo@apple.com

DFG string concatenation optimizations might emit speculative nodes after...

DFG string concatenation optimizations might emit speculative nodes after emitting nodes that kill the original inputs
https://bugs.webkit.org/show_bug.cgi?id=119032

Reviewed by Oliver Hunt.

Source/JavaScriptCore: 

It just needs some Phantom action.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):

LayoutTests: 

* fast/js/dfg-strcat-over-objects-then-exit-on-it-expected.txt: Added.
* fast/js/dfg-strcat-over-objects-then-exit-on-it.html: Added.
* fast/js/script-tests/dfg-strcat-over-objects-then-exit-on-it.js: Added.
(foo):
(bar):
(x):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153075 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 70165470
2013-07-23 Filip Pizlo <fpizlo@apple.com>
DFG string concatenation optimizations might emit speculative nodes after emitting nodes that kill the original inputs
https://bugs.webkit.org/show_bug.cgi?id=119032
Reviewed by Oliver Hunt.
* fast/js/dfg-strcat-over-objects-then-exit-on-it-expected.txt: Added.
* fast/js/dfg-strcat-over-objects-then-exit-on-it.html: Added.
* fast/js/script-tests/dfg-strcat-over-objects-then-exit-on-it.js: Added.
(foo):
(bar):
(x):
2013-07-23 Mark Lam <mark.lam@apple.com>
Added ExpressionRangeInfo for BinaryOpNodes that can throw exceptions
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="resources/js-test-pre.js"></script>
</head>
<body>
<script src="script-tests/dfg-strcat-over-objects-then-exit-on-it.js"></script>
<script src="resources/js-test-post.js"></script>
</body>
</html>
description(
"Tests what happens when you do string concatentations on objects and then OSR exit when it turns out to be an int."
);
function foo() {
return x;
}
function bar() {
return foo() + '';
}
var x = function() { };
var expected = "\"function () { }\"";
var blah = this;
for (var i = 0; i < 1000; ++i) {
blah["i" + i] = i;
if (i == 700) {
x = 42;
expected = "\"42\"";
}
shouldBe("bar()", expected);
}
2013-07-23 Filip Pizlo <fpizlo@apple.com>
DFG string concatenation optimizations might emit speculative nodes after emitting nodes that kill the original inputs
https://bugs.webkit.org/show_bug.cgi?id=119032
Reviewed by Oliver Hunt.
It just needs some Phantom action.
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
2013-07-10 Mark Lam <mark.lam@apple.com>
Need ExpressionRangeInfo before ResolveForPuts in strict mode.
......
......@@ -1032,6 +1032,9 @@ private:
template<UseKind leftUseKind>
bool attemptToMakeFastStringAdd(Node* node, Edge& left, Edge& right)
{
Node* originalLeft = left.node();
Node* originalRight = right.node();
ASSERT(leftUseKind == StringUse || leftUseKind == StringObjectUse || leftUseKind == StringOrStringObjectUse);
if (isStringObjectUse<leftUseKind>() && !canOptimizeStringObjectAccess(node->codeOrigin))
......@@ -1066,6 +1069,12 @@ private:
right.setNode(toString);
}
// We're doing checks up there, so we need to make sure that the
// *original* inputs to the addition are live up to here.
m_insertionSet.insertNode(
m_indexInBlock, SpecNone, Phantom, node->codeOrigin,
Edge(originalLeft), Edge(originalRight));
convertToMakeRope(node);
return true;
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment