nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/js/dfg-compare-final-object-to...

10 lines
372 B
Plaintext
Raw Permalink Normal View History

ASSERTION FAILED: at(m_compileIndex).canExit() || m_isCheckingArgumentTypes https://bugs.webkit.org/show_bug.cgi?id=91074 Reviewed by Mark Hahnenberg. Source/JavaScriptCore: Fixes a bug where the speculative JIT was performing an unnecessary speculation that the CFA had proven shouldn't be performed, leading to asserts that a node should not have exit sites. This is a debug-only assert with no release symptom - we were just emitting a check that was not reachable. Also found, and fixed, a bug where structure check hoisting was slightly confusing the CFA by inserting GetLocal's into the graph. CSE would clean the GetLocal's up, which would make the backend happy - but the CFA would produce subtly wrong results. * bytecode/SpeculatedType.h: (JSC::isOtherOrEmptySpeculation): (JSC): * dfg/DFGDriver.cpp: (JSC::DFG::compile): * dfg/DFGGraph.cpp: (JSC::DFG::Graph::dump): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality): (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality): LayoutTests: Added a test for this specific case (dfg-peephole-compare-final-object-to-final-object-or-other-when-both-proven-final-object) as well as three other tests to cover similar, though not necessarily currently broken, cases, since it was previously the case that we apparently had no explicit coverage for these code paths. * fast/js/dfg-compare-final-object-to-final-object-or-other-when-both-proven-final-object-expected.txt: Added. * fast/js/dfg-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html: Added. * fast/js/dfg-compare-final-object-to-final-object-or-other-when-proven-final-object-expected.txt: Added. * fast/js/dfg-compare-final-object-to-final-object-or-other-when-proven-final-object.html: Added. * fast/js/dfg-peephole-compare-final-object-to-final-object-or-other-when-both-proven-final-object-expected.txt: Added. * fast/js/dfg-peephole-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html: Added. * fast/js/dfg-peephole-compare-final-object-to-final-object-or-other-when-proven-final-object-expected.txt: Added. * fast/js/dfg-peephole-compare-final-object-to-final-object-or-other-when-proven-final-object.html: Added. * fast/js/script-tests/dfg-compare-final-object-to-final-object-or-other-when-both-proven-final-object.js: Added. (foo): * fast/js/script-tests/dfg-compare-final-object-to-final-object-or-other-when-proven-final-object.js: Added. (foo): * fast/js/script-tests/dfg-peephole-compare-final-object-to-final-object-or-other-when-both-proven-final-object.js: Added. (foo): * fast/js/script-tests/dfg-peephole-compare-final-object-to-final-object-or-other-when-proven-final-object.js: Added. (foo): Canonical link: https://commits.webkit.org/110904@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@124555 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2012-08-03 03:27:08 +00:00
Tests that the CompareEq optimization for the case where one side is predicted final object and the other side is predicted either final object or other (i.e. null or undefined) doesn't assert when the other side is also proven final object.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
REGRESSION(149636, merged in 153145): ToThis conversion doesn't work in the DFG https://bugs.webkit.org/show_bug.cgi?id=120781 Reviewed by Mark Hahnenberg. Roll this back in with a build fix. - Use some method table hacks to detect if the CheckStructure optimization is valid for to_this. - Introduce a FinalObjectUse and use it for ToThis->Identity conversion. This looks like it might be perf-neutral on the major benchmarks, but it introduces some horrible performance cliffs. For example if you add methods to the Array prototype, you'll get horrible performance cliffs. As in virtual calls to C++ every time you call a JS function even if it's inlined. LongSpider/3d-cube appears to hit this. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::::executeEffects): * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGRepatch.cpp: (JSC::DFG::emitPutTransitionStub): * dfg/DFGSafeToExecute.h: (JSC::DFG::SafeToExecuteEdge::operator()): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::speculateFinalObject): (JSC::DFG::SpeculativeJIT::speculate): * dfg/DFGSpeculativeJIT.h: * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGUseKind.cpp: (WTF::printInternal): * dfg/DFGUseKind.h: (JSC::DFG::typeFilterFor): (JSC::DFG::isCell): Canonical link: https://commits.webkit.org/138810@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@155201 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2013-09-06 19:01:21 +00:00
Passed some tests silently.
ASSERTION FAILED: at(m_compileIndex).canExit() || m_isCheckingArgumentTypes https://bugs.webkit.org/show_bug.cgi?id=91074 Reviewed by Mark Hahnenberg. Source/JavaScriptCore: Fixes a bug where the speculative JIT was performing an unnecessary speculation that the CFA had proven shouldn't be performed, leading to asserts that a node should not have exit sites. This is a debug-only assert with no release symptom - we were just emitting a check that was not reachable. Also found, and fixed, a bug where structure check hoisting was slightly confusing the CFA by inserting GetLocal's into the graph. CSE would clean the GetLocal's up, which would make the backend happy - but the CFA would produce subtly wrong results. * bytecode/SpeculatedType.h: (JSC::isOtherOrEmptySpeculation): (JSC): * dfg/DFGDriver.cpp: (JSC::DFG::compile): * dfg/DFGGraph.cpp: (JSC::DFG::Graph::dump): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality): (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality): LayoutTests: Added a test for this specific case (dfg-peephole-compare-final-object-to-final-object-or-other-when-both-proven-final-object) as well as three other tests to cover similar, though not necessarily currently broken, cases, since it was previously the case that we apparently had no explicit coverage for these code paths. * fast/js/dfg-compare-final-object-to-final-object-or-other-when-both-proven-final-object-expected.txt: Added. * fast/js/dfg-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html: Added. * fast/js/dfg-compare-final-object-to-final-object-or-other-when-proven-final-object-expected.txt: Added. * fast/js/dfg-compare-final-object-to-final-object-or-other-when-proven-final-object.html: Added. * fast/js/dfg-peephole-compare-final-object-to-final-object-or-other-when-both-proven-final-object-expected.txt: Added. * fast/js/dfg-peephole-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html: Added. * fast/js/dfg-peephole-compare-final-object-to-final-object-or-other-when-proven-final-object-expected.txt: Added. * fast/js/dfg-peephole-compare-final-object-to-final-object-or-other-when-proven-final-object.html: Added. * fast/js/script-tests/dfg-compare-final-object-to-final-object-or-other-when-both-proven-final-object.js: Added. (foo): * fast/js/script-tests/dfg-compare-final-object-to-final-object-or-other-when-proven-final-object.js: Added. (foo): * fast/js/script-tests/dfg-peephole-compare-final-object-to-final-object-or-other-when-both-proven-final-object.js: Added. (foo): * fast/js/script-tests/dfg-peephole-compare-final-object-to-final-object-or-other-when-proven-final-object.js: Added. (foo): Canonical link: https://commits.webkit.org/110904@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@124555 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2012-08-03 03:27:08 +00:00
TEST COMPLETE