https://bugs.webkit.org/show_bug.cgi?id=118745
Source/JavaScriptCore:
Reviewed by Mark Hahnenberg.
Make the empty string pruning part of fixupMakeRope() stop if it's on the last child.
Make Node::convertToIdentity release-assert that it has exactly one kid.
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupMakeRope):
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToIdentity):
LayoutTests:
Reviewed by Mark Hahnenberg.
* fast/js/dfg-make-rope-all-empty-strings.html: Added.
* fast/js/dfg-make-rope-all-empty-strings-expected.txt: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-make-rope-all-empty-strings.js: Added.
(foo):
(bar):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@152742
268f45cc-cd09-0410-ab3c-
d52691b4dbfc
+2013-07-16 Filip Pizlo <fpizlo@apple.com>
+
+ MakeRope fixup shouldn't lead to an Identity without kids
+ https://bugs.webkit.org/show_bug.cgi?id=118745
+
+ Reviewed by Mark Hahnenberg.
+
+ * fast/js/dfg-make-rope-all-empty-strings.html: Added.
+ * fast/js/dfg-make-rope-all-empty-strings-expected.txt: Added.
+ * fast/js/jsc-test-list:
+ * fast/js/script-tests/dfg-make-rope-all-empty-strings.js: Added.
+ (foo):
+ (bar):
+
2013-07-16 Roger Fong <roger_fong@apple.com>
Unreviewed rebaseline test added in r152612 for Apple Windows port.
--- /dev/null
+Check that the DFG can handle MakeRope or ValueAdd on all empty strings.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS bar() is ""
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
--- /dev/null
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/dfg-make-rope-all-empty-strings.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
fast/js/dfg-intrinsic-side-effect-assignment-osr-exit
fast/js/dfg-intrinsic-unused-this
fast/js/dfg-intrinsic-unused-this-method-check
+fast/js/dfg-make-rope-all-empty-strings
fast/js/dfg-max-backwards-propagation
fast/js/dfg-min-backwards-propagation
fast/js/dfg-min-max
--- /dev/null
+description(
+"Check that the DFG can handle MakeRope or ValueAdd on all empty strings."
+);
+
+function foo(a, b) {
+ return a + b;
+}
+
+function bar() {
+ return foo("", "");
+}
+
+for (var i = 0; i < 100; ++i)
+ shouldBe("bar()", "\"\"");
+
+2013-07-16 Filip Pizlo <fpizlo@apple.com>
+
+ MakeRope fixup shouldn't lead to an Identity without kids
+ https://bugs.webkit.org/show_bug.cgi?id=118745
+
+ Reviewed by Mark Hahnenberg.
+
+ Make the empty string pruning part of fixupMakeRope() stop if it's on the last child.
+
+ Make Node::convertToIdentity release-assert that it has exactly one kid.
+
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupMakeRope):
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::convertToIdentity):
+
2013-07-16 Mark Hahnenberg <mhahnenberg@apple.com>
Remove reference to JSValueStructSupport.h from JSExport.h
JSString* string = jsCast<JSString*>(m_graph.valueOfJSConstant(edge.node()).asCell());
if (string->length())
continue;
+
+ // Don't allow the MakeRope to have zero children.
+ if (!i && !node->child2())
+ break;
+
node->children.removeEdge(i--);
}
void convertToIdentity()
{
+ RELEASE_ASSERT(child1());
+ RELEASE_ASSERT(!child2());
setOpAndDefaultNonExitFlags(Identity);
}