Unreviewed, rolling out r204697
authorutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 21 Aug 2016 20:36:49 +0000 (20:36 +0000)
committerutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 21 Aug 2016 20:36:49 +0000 (20:36 +0000)
https://bugs.webkit.org/show_bug.cgi?id=161029

JSTests:

* typeProfiler/int52-dfg.js: Removed.
(test): Deleted.
* typeProfiler/number-filter-dfg.js: Removed.
(test): Deleted.

Source/JavaScriptCore:

32bit is OK. DFGSpeculativeJIT64.cpp shortcut also need some cares.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@204698 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JSTests/ChangeLog
JSTests/typeProfiler/int52-dfg.js [deleted file]
JSTests/typeProfiler/number-filter-dfg.js [deleted file]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

index 9f81f9f..d8f285b 100644 (file)
@@ -1,5 +1,15 @@
 2016-08-21  Yusuke Suzuki  <utatane.tea@gmail.com>
 
+        Unreviewed, rolling out r204697
+        https://bugs.webkit.org/show_bug.cgi?id=161029
+
+        * typeProfiler/int52-dfg.js: Removed.
+        (test): Deleted.
+        * typeProfiler/number-filter-dfg.js: Removed.
+        (test): Deleted.
+
+2016-08-21  Yusuke Suzuki  <utatane.tea@gmail.com>
+
         [DFG] Should not fixup AnyIntUse in 32_64
         https://bugs.webkit.org/show_bug.cgi?id=161029
 
diff --git a/JSTests/typeProfiler/int52-dfg.js b/JSTests/typeProfiler/int52-dfg.js
deleted file mode 100644 (file)
index 004fa4b..0000000
+++ /dev/null
@@ -1,15 +0,0 @@
-load("./driver/driver.js");
-
-function test()
-{
-    var ok = 0;
-    for (var i = 0; i < 1e4; ++i) {
-        ok += 0xfffffffff;  // Int52
-    }
-    return ok;
-}
-test();
-
-var types = findTypeForExpression(test, "ok += 0x");
-assert(types.instructionTypeSet.primitiveTypeNames.length === 1, "Primitive type names should one candidate.");
-assert(types.instructionTypeSet.primitiveTypeNames.indexOf(T.Integer) !== -1, "Primitive type names should contain 'Integer'");
diff --git a/JSTests/typeProfiler/number-filter-dfg.js b/JSTests/typeProfiler/number-filter-dfg.js
deleted file mode 100644 (file)
index 671503c..0000000
+++ /dev/null
@@ -1,16 +0,0 @@
-load("./driver/driver.js");
-
-function test(value)
-{
-    var ok = 0.5;
-    ok += value;
-    return ok;
-}
-noInline(test);
-for (var i = 0; i < 1e4; ++i)
-    test(1.2);
-test(0.5);
-var types = findTypeForExpression(test, "ok += value");
-assert(types.instructionTypeSet.primitiveTypeNames.length === 2, "Primitive type names should two candidates.");
-assert(types.instructionTypeSet.primitiveTypeNames.indexOf(T.Integer) !== -1, "Primitive type names should contain 'Integer'");
-assert(types.instructionTypeSet.primitiveTypeNames.indexOf(T.Number) !== -1, "Primitive type names should contain 'Number'");
index 5014959..fae3dc0 100644 (file)
@@ -1,5 +1,15 @@
 2016-08-21  Yusuke Suzuki  <utatane.tea@gmail.com>
 
+        Unreviewed, rolling out r204697
+        https://bugs.webkit.org/show_bug.cgi?id=161029
+
+        32bit is OK. DFGSpeculativeJIT64.cpp shortcut also need some cares.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2016-08-21  Yusuke Suzuki  <utatane.tea@gmail.com>
+
         [DFG] Should not fixup AnyIntUse in 32_64
         https://bugs.webkit.org/show_bug.cgi?id=161029
 
index 948a57e..3bb156b 100644 (file)
@@ -1459,23 +1459,12 @@ private:
             RefPtr<TypeSet> typeSet = node->typeLocation()->m_instructionTypeSet;
             RuntimeTypeMask seenTypes = typeSet->seenTypes();
             if (typeSet->doesTypeConformTo(TypeAnyInt)) {
-                if (node->child1()->shouldSpeculateInt32()) {
+                if (node->child1()->shouldSpeculateInt32())
                     fixEdge<Int32Use>(node->child1());
-                    node->remove();
-                    break;
-                }
-
-                if (enableInt52()) {
+                else
                     fixEdge<AnyIntUse>(node->child1());
-                    node->remove();
-                    break;
-                }
-
-                // Must not perform fixEdge<NumberUse> here since the type set only includes TypeAnyInt. Double values should be logged.
-            }
-
-            if (typeSet->doesTypeConformTo(TypeNumber | TypeAnyInt) && ((seenTypes & TypeNumber) && (seenTypes & TypeAnyInt))) {
-                // NumberUse can pass TypeNumber and TypeAnyInt. Thus, this node removal is allowed only if both TypeNumber and TypeAnyInt are logged in the type set.
+                node->remove();
+            } else if (typeSet->doesTypeConformTo(TypeNumber | TypeAnyInt)) {
                 fixEdge<NumberUse>(node->child1());
                 node->remove();
             } else if (typeSet->doesTypeConformTo(TypeString)) {