Incorrect merge of r117542 from dfg opt branch in r118323 is leading to fast/js/dfg-arguments-osr-exit.html failing
https://bugs.webkit.org/show_bug.cgi?id=87350
Reviewed by Maciej Stachowiak.
The dfgopt branch introduced the notion of a local variable being killed because it was aliased
to the Arguments object as in cases like:
var a = arguments;
return a.length;
This required changes to OSR exit handling - if the variable is dead but aliased to arguments, then
OSR exit should reify the arguments. But meanwhile, in tip of tree we introduced special handling for
dead variables on OSR exit. When the two were merged in r118323, the structure of the if/else branches
ended up being such that we would treat dead arguments variables as totally dead as opposed to treating
them as variables that need arguments reification.
This fixes the structure of the relevant if/else block so that variables that are dead-but-arguments
end up being treated as reified arguments objects, while variables that are dead but not aliased to
arguments are treated as tip of tree would have treated them (initialize to Undefined).
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compile):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118333 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index d16f918..913e2f8 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,29 @@
+2012-05-24 Filip Pizlo <fpizlo@apple.com>
+
+ Incorrect merge of r117542 from dfg opt branch in r118323 is leading to fast/js/dfg-arguments-osr-exit.html failing
+ https://bugs.webkit.org/show_bug.cgi?id=87350
+
+ Reviewed by Maciej Stachowiak.
+
+ The dfgopt branch introduced the notion of a local variable being killed because it was aliased
+ to the Arguments object as in cases like:
+
+ var a = arguments;
+ return a.length;
+
+ This required changes to OSR exit handling - if the variable is dead but aliased to arguments, then
+ OSR exit should reify the arguments. But meanwhile, in tip of tree we introduced special handling for
+ dead variables on OSR exit. When the two were merged in r118323, the structure of the if/else branches
+ ended up being such that we would treat dead arguments variables as totally dead as opposed to treating
+ them as variables that need arguments reification.
+
+ This fixes the structure of the relevant if/else block so that variables that are dead-but-arguments
+ end up being treated as reified arguments objects, while variables that are dead but not aliased to
+ arguments are treated as tip of tree would have treated them (initialize to Undefined).
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+
2012-05-24 Csaba Osztrogonác <ossy@webkit.org>
Unreviewed 32 bit buildfix after r118325.
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 95f030b..db71fc0 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -994,12 +994,14 @@
// https://bugs.webkit.org/show_bug.cgi?id=87205
if (m_jit.codeBlock()->localIsCaptured(at(block[0]).codeOrigin.inlineCallFrame, i))
m_variables[i] = ValueSource(ValueInRegisterFile);
- else if (nodeIndex == NoNode || !at(nodeIndex).refCount())
+ else if (nodeIndex == NoNode)
+ m_variables[i] = ValueSource(SourceIsDead);
+ else if (at(nodeIndex).variableAccessData()->isArgumentsAlias())
+ m_variables[i] = ValueSource(ArgumentsSource);
+ else if (!at(nodeIndex).refCount())
m_variables[i] = ValueSource(SourceIsDead);
else if (at(nodeIndex).variableAccessData()->shouldUseDoubleFormat())
m_variables[i] = ValueSource(DoubleInRegisterFile);
- else if (at(nodeIndex).variableAccessData()->isArgumentsAlias())
- m_variables[i] = ValueSource(ArgumentsSource);
else
m_variables[i] = ValueSource::forPrediction(at(nodeIndex).variableAccessData()->prediction());
}
