mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
[INFER] Restrict tracked loop test information to known integers, bug 658290.
This commit is contained in:
parent
b87d5cbe5d
commit
aee058456f
8
js/src/jit-test/tests/jaeger/loops/bug658290.js
Normal file
8
js/src/jit-test/tests/jaeger/loops/bug658290.js
Normal file
@ -0,0 +1,8 @@
|
||||
var SECTION = "15.4.5.2-2";
|
||||
addCase(new Array, 0, Math, Math.pow(2, SECTION));
|
||||
var arg = "", i = 0;
|
||||
var a = eval("new Array(" + arg + ")");
|
||||
addCase(a, i, +i + 1, Math.pow(2, 12) + i + 1, true);
|
||||
function addCase(object, old_len, set_len, new_len, checkitems) {
|
||||
for (var i = old_len; i < new_len; i++) if (object[i] != 0) {}
|
||||
}
|
30
js/src/jit-test/tests/jaeger/recompile/bug658212.js
Normal file
30
js/src/jit-test/tests/jaeger/recompile/bug658212.js
Normal file
@ -0,0 +1,30 @@
|
||||
var gTestcases = Array;
|
||||
function TestCase(n, d, e, a) {
|
||||
this.description = d
|
||||
gTestcases[gTc] = this
|
||||
}
|
||||
TestCase.prototype.dump=function () + + +
|
||||
+ this.description + +
|
||||
+ + '\n';function printStatus (msg)
|
||||
function toPrinted(value) {
|
||||
}
|
||||
function reportCompare(expected, actual, description) {
|
||||
new TestCase("unknown-test-name", description, expected, actual)
|
||||
}
|
||||
gTc = 0;;
|
||||
function jsTestDriverEnd() {
|
||||
for (var i = 0; i < gTestcases.length; i++)
|
||||
gTestcases[i].dump()
|
||||
}
|
||||
var summary = 'Do not assert with try/finally inside finally';
|
||||
var expect = 'No Crash';
|
||||
reportCompare(expect, printStatus, summary);
|
||||
jsTestDriverEnd();
|
||||
jsTestDriverEnd();
|
||||
try {
|
||||
f
|
||||
} catch (ex) {
|
||||
actual = ''
|
||||
}
|
||||
reportCompare(expect, actual, 5);
|
||||
jsTestDriverEnd()
|
@ -1096,7 +1096,8 @@ mjit::Compiler::jsop_setelem_dense()
|
||||
RegisterID slotsReg;
|
||||
analyze::CrossSSAValue objv(a->inlineIndex, analysis->poppedValue(PC, 2));
|
||||
analyze::CrossSSAValue indexv(a->inlineIndex, analysis->poppedValue(PC, 1));
|
||||
bool hoisted = loop && loop->hoistArrayLengthCheck(objv, indexv);
|
||||
bool hoisted = loop && id->isType(JSVAL_TYPE_INT32) &&
|
||||
loop->hoistArrayLengthCheck(objv, indexv);
|
||||
|
||||
if (hoisted) {
|
||||
FrameEntry *slotsFe = loop->invariantSlots(objv);
|
||||
@ -1417,7 +1418,8 @@ mjit::Compiler::jsop_getelem_dense(bool isPacked)
|
||||
|
||||
analyze::CrossSSAValue objv(a->inlineIndex, analysis->poppedValue(PC, 1));
|
||||
analyze::CrossSSAValue indexv(a->inlineIndex, analysis->poppedValue(PC, 0));
|
||||
bool hoisted = loop && loop->hoistArrayLengthCheck(objv, indexv);
|
||||
bool hoisted = loop && id->isType(JSVAL_TYPE_INT32) &&
|
||||
loop->hoistArrayLengthCheck(objv, indexv);
|
||||
|
||||
// Get a register with either the object or its slots, depending on whether
|
||||
// we are hoisting the bounds check.
|
||||
|
@ -505,6 +505,10 @@ LoopState::setLoopReg(AnyRegisterID reg, FrameEntry *fe)
|
||||
bool
|
||||
LoopState::hoistArrayLengthCheck(const CrossSSAValue &obj, const CrossSSAValue &index)
|
||||
{
|
||||
/*
|
||||
* Note: this method requires that obj is either a dense array or not an
|
||||
* object, and that the index is definitely an integer.
|
||||
*/
|
||||
if (skipAnalysis)
|
||||
return false;
|
||||
|
||||
@ -1333,11 +1337,6 @@ LoopState::getLoopTestAccess(const SSAValue &v, uint32 *pslot, int32 *pconstant)
|
||||
if (outerAnalysis->slotEscapes(slot))
|
||||
return false;
|
||||
|
||||
/* Only consider tests on known integers. */
|
||||
TypeSet *types = outerAnalysis->pushedTypes(pc, 0);
|
||||
if (types->getKnownTypeTag(cx) != JSVAL_TYPE_INT32)
|
||||
return false;
|
||||
|
||||
*pslot = slot;
|
||||
if (cs->format & JOF_POST) {
|
||||
if (cs->format & JOF_INC)
|
||||
@ -1394,6 +1393,12 @@ LoopState::analyzeLoopTest()
|
||||
SSAValue one = outerAnalysis->poppedValue(test.pushedOffset(), 1);
|
||||
SSAValue two = outerAnalysis->poppedValue(test.pushedOffset(), 0);
|
||||
|
||||
/* The test must be comparing known integers. */
|
||||
if (outerAnalysis->getValueTypes(one)->getKnownTypeTag(cx) != JSVAL_TYPE_INT32 ||
|
||||
outerAnalysis->getValueTypes(two)->getKnownTypeTag(cx) != JSVAL_TYPE_INT32) {
|
||||
return;
|
||||
}
|
||||
|
||||
/* Reverse the condition if the RHS is modified by the loop. */
|
||||
uint32 swapRHS;
|
||||
int32 swapConstant;
|
||||
|
Loading…
Reference in New Issue
Block a user