haikuwebkit/LayoutTests/js/dfg-check-function-change-s...

Passed some tests silently.

TEST COMPLETE
fast/js/dfg-* tests should wait for the concurrent JIT https://bugs.webkit.org/show_bug.cgi?id=120723 Rubber stamped by Oliver Hunt. Convert more tests. * fast/js/dfg-branch-logical-not-peephole-around-osr-exit-expected.txt: * fast/js/dfg-branch-not-fail-expected.txt: * fast/js/dfg-byte-array-put-expected.txt: * fast/js/dfg-call-function-hit-watchpoint-expected.txt: * fast/js/dfg-call-method-hit-watchpoint-expected.txt: * fast/js/dfg-captured-var-get-local-expected.txt: * fast/js/dfg-cfa-merge-with-dead-use-at-tail-expected.txt: * fast/js/dfg-cfg-simplify-eliminate-set-local-type-check-then-branch-not-null-and-decrement-expected.txt: * fast/js/dfg-cfg-simplify-eliminate-set-local-type-check-then-branch-not-null-expected.txt: * fast/js/dfg-cfg-simplify-eliminate-set-local-type-check-then-typeof-expected.txt: * fast/js/dfg-cfg-simplify-phantom-get-local-on-same-block-set-local-expected.txt: * fast/js/dfg-cfg-simplify-redundant-dead-get-local-expected.txt: * fast/js/dfg-check-function-change-structure-expected.txt: * fast/js/jsc-test-list: * fast/js/script-tests/dfg-branch-logical-not-peephole-around-osr-exit.js: * fast/js/script-tests/dfg-branch-not-fail.js: * fast/js/script-tests/dfg-byte-array-put.js: * fast/js/script-tests/dfg-call-function-hit-watchpoint.js: * fast/js/script-tests/dfg-call-method-hit-watchpoint.js: * fast/js/script-tests/dfg-captured-var-get-local.js: * fast/js/script-tests/dfg-cfa-merge-with-dead-use-at-tail.js: * fast/js/script-tests/dfg-cfg-simplify-eliminate-set-local-type-check-then-branch-not-null-and-decrement.js: * fast/js/script-tests/dfg-cfg-simplify-eliminate-set-local-type-check-then-branch-not-null.js: * fast/js/script-tests/dfg-cfg-simplify-eliminate-set-local-type-check-then-typeof.js: * fast/js/script-tests/dfg-cfg-simplify-phantom-get-local-on-same-block-set-local.js: * fast/js/script-tests/dfg-cfg-simplify-redundant-dead-get-local.js: * fast/js/script-tests/dfg-check-function-change-structure.js: Canonical link: https://commits.webkit.org/138734@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@155122 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2013-09-05 15:54:07 +00:00			`Passed some tests silently.`
DFG CFA filters CheckFunction in a really weird way, and assumes that the function's structure won't change https://bugs.webkit.org/show_bug.cgi?id=115077 Source/JavaScriptCore: Reviewed by Oliver Hunt. The filtering did three things that are unusual: 1) AbstractValue::filterByValue() assumed that the passed value's structure wouldn't change, in the sense that at it assumed it could use that value's current structure to do structure filtering. Filtering by structure only makes sense if you can prove that the given value will always have that structure (for example by either using a watchpoing or emitting code that checks that structure at run-time). 2) AbstractValue::filterByValue() and the CheckFunction case in AbstractState::executeEffects() tried to invalidate the CFA based on whether the filtration led to an empty value. This is well-intentioned, but it's not how the CFA currently works. It's inconsistent with other parts of the CFA. We shouldn't introduce this feature into just one kind of filtration and not have it elsewhere. 3) The attempt to detect when the value was empty was actually implemented incorrectly. It relied on AbstractValue::validate(). That method says that a concrete value does not belong to the abstract value if it has a different structure. This makes sense for the other place where AbstractValue::validate() is called: during OSR entry, where we are talking about a JSValue that we see right now. It doesn't make sense in the CFA, since in the CFA any value we observe in the code is a value whose structure may change when the code starts running, and so we cannot use the value's current structure to infer things about the code when it starts running. I fixed the above problems by (1) changing filterByValue() to not filter the structure, (2) changing filterByValue() and the CheckFunction case to not invalidate the CFA, and (3) making sure that nobody else was misusing AbstractValue::validate() (they weren't). * dfg/DFGAbstractState.cpp: (JSC::DFG::AbstractState::executeEffects): * dfg/DFGAbstractValue.h: (JSC::DFG::AbstractValue::filterByValue): LayoutTests: Reviewed by Oliver Hunt. This hilarious test fails prior to the rest of this patch. * fast/js/dfg-check-function-change-structure-expected.txt: Added. * fast/js/dfg-check-function-change-structure.html: Added. * fast/js/jsc-test-list: * fast/js/script-tests/dfg-check-function-change-structure.js: Added. (foo): (bar): Canonical link: https://commits.webkit.org/133515@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@149016 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2013-04-24 03:18:04 +00:00
			`TEST COMPLETE`