DFGAbstractInterpreter should not claim Int52 arithmetic creates Int52s
https://bugs.webkit.org/show_bug.cgi?id=132446
Reviewed by Mark Hahnenberg.
Source/JavaScriptCore:
Basically any arithmetic operation can turn an Int52 into an Int32 or vice-versa, and
our modeling of Int52Rep nodes is such that they can have either Int32 or Int52 type
to indicate a bound on the value. This is useful for knowing, for example, that
Int52Rep(Int32:) returns a value that cannot be outside the Int32 range. Also,
ValueRep(Int52Rep:) uses this to determine whether it may return a double or an int.
But this means that all arithmetic operations must be careful to note that they may
turn Int32 inputs into an Int52 output or vice-versa, as these new tests show.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::makeSafe):
* tests/stress/int52-ai-add-then-filter-int32.js: Added.
(foo):
* tests/stress/int52-ai-mul-and-clean-neg-zero-then-filter-int32.js: Added.
(foo):
* tests/stress/int52-ai-mul-then-filter-int32-directly.js: Added.
(foo):
* tests/stress/int52-ai-mul-then-filter-int32.js: Added.
(foo):
* tests/stress/int52-ai-neg-then-filter-int32.js: Added.
(foo):
* tests/stress/int52-ai-sub-then-filter-int32.js: Added.
(foo):
Tools:
Test the FTL by default now that it's enabled by default.
* Scripts/run-javascriptcore-tests:
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@168172 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
index 39c06ab..a8f404a 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
+++ b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
@@ -376,7 +376,7 @@
break;
}
}
- forNode(node).setType(SpecInt52);
+ forNode(node).setType(SpecMachineInt);
if (!forNode(node->child1()).isType(SpecInt32)
|| !forNode(node->child2()).isType(SpecInt32))
node->setCanExit(true);
@@ -431,7 +431,7 @@
break;
}
}
- forNode(node).setType(SpecInt52);
+ forNode(node).setType(SpecMachineInt);
if (!forNode(node->child1()).isType(SpecInt32)
|| !forNode(node->child2()).isType(SpecInt32))
node->setCanExit(true);
@@ -489,7 +489,7 @@
break;
}
}
- forNode(node).setType(SpecInt52);
+ forNode(node).setType(SpecMachineInt);
if (m_state.forNode(node->child1()).couldBeType(SpecInt52))
node->setCanExit(true);
if (shouldCheckNegativeZero(node->arithMode()))
@@ -545,7 +545,7 @@
break;
}
}
- forNode(node).setType(SpecInt52);
+ forNode(node).setType(SpecMachineInt);
node->setCanExit(true);
break;
case DoubleRepUse:
