DFG performs incorrect DCE on (some?) intrinsics
https://bugs.webkit.org/show_bug.cgi?id=84746
<rdar://problem/11310772>
Source/JavaScriptCore:
Reviewed by Oliver Hunt.
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGByteCodeParser.cpp:
(ByteCodeParser):
(JSC::DFG::ByteCodeParser::setIntrinsicResult):
(JSC::DFG::ByteCodeParser::handleMinMax):
(JSC::DFG::ByteCodeParser::handleIntrinsic):
* dfg/DFGNodeType.h:
(DFG):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
LayoutTests:
Rubber stamped by Oliver Hunt.
* fast/js/dfg-dead-min-one-arg-expected.txt: Added.
* fast/js/dfg-dead-min-one-arg.html: Added.
* fast/js/dfg-dead-min-two-args-expected.txt: Added.
* fast/js/dfg-dead-min-two-args.html: Added.
* fast/js/script-tests/dfg-dead-min-one-arg.js: Added.
(foo):
(.x.f.valueOf):
* fast/js/script-tests/dfg-dead-min-two-args.js: Added.
(foo):
(bar):
(.x.f.valueOf):
(.y.f.valueOf):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@115103 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
index ad01df3..0beec9d 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
@@ -310,6 +310,10 @@
forNode(node.child1()).filter(PredictNumber);
forNode(nodeIndex).set(PredictDouble);
break;
+
+ case CheckNumber:
+ forNode(node.child1()).filter(PredictNumber);
+ break;
case ValueAdd:
case ArithAdd: {
