[DFG] Should not fixup AnyIntUse in 32_64
authorutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 21 Aug 2016 19:45:50 +0000 (19:45 +0000)
committerutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 21 Aug 2016 19:45:50 +0000 (19:45 +0000)
commite078559e106065ca1d8bdbffa216967ecc6636f9
treee8eef83e786c43d89844c1edeaa90911090bb56b
parent596c3831218e8482a886a0f511e62a8b0ba70b38
[DFG] Should not fixup AnyIntUse in 32_64
https://bugs.webkit.org/show_bug.cgi?id=161029

Reviewed by Saam Barati.

JSTests:

* typeProfiler/int52-dfg.js: Added.
(test):
* typeProfiler/number-filter-dfg.js: Added.
(test):

Source/JavaScriptCore:

DFG fixup phase uses AnyIntUse even in 32bit DFG. This patch removes this incorrect filtering.
If the 32bit DFG see the TypeAnyInt, it should fallback to the NumberUse case.

And this patch also fixes the case that the type set only contains TypeNumber. Previously,
we used NumberUse edge filtering. But it misses AnyInt logging: While the NumberUse filter
passes both TypeAnyInt and TypeNumber, the type set only logged TypeNumber.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@204697 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/typeProfiler/int52-dfg.js [new file with mode: 0644]
JSTests/typeProfiler/number-filter-dfg.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGFixupPhase.cpp