wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

[INFER] Restrict tracked loop test information to known integers, bug 658290.

Browse Source
This commit is contained in:
Brian Hackett 2011-05-19 15:02:36 -07:00
parent b87d5cbe5d
commit aee058456f
4 changed files with 52 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
js/src/jit-test/tests/jaeger/loops/bug658290.js Normal file
View File

@ -0,0 +1,8 @@
var SECTION = "15.4.5.2-2";
addCase(new Array, 0, Math, Math.pow(2, SECTION));
var arg = "", i = 0;
var a = eval("new Array(" + arg + ")");
addCase(a, i, +i + 1, Math.pow(2, 12) + i + 1, true);
function addCase(object, old_len, set_len, new_len, checkitems) {
for (var i = old_len; i < new_len; i++) if (object[i] != 0) {}
}

30
js/src/jit-test/tests/jaeger/recompile/bug658212.js Normal file
View File

@ -0,0 +1,30 @@
var gTestcases = Array;
function TestCase(n, d, e, a) {
this.description = d
gTestcases[gTc] = this
}
TestCase.prototype.dump=function () + + +
+ this.description + +
+ + '\n';function printStatus (msg)
function toPrinted(value) {
}
function reportCompare(expected, actual, description) {
new TestCase("unknown-test-name", description, expected, actual)
}
gTc = 0;;
function jsTestDriverEnd() {
for (var i = 0; i < gTestcases.length; i++)
gTestcases[i].dump()
}
var summary = 'Do not assert with try/finally inside finally';
var expect = 'No Crash';
reportCompare(expect, printStatus, summary);
jsTestDriverEnd();
jsTestDriverEnd();
try {
f
} catch (ex) {
actual = ''
}
reportCompare(expect, actual, 5);
jsTestDriverEnd()

6
js/src/methodjit/FastOps.cpp
View File

@ -1096,7 +1096,8 @@ mjit::Compiler::jsop_setelem_dense()
RegisterID slotsReg;
analyze::CrossSSAValue objv(a->inlineIndex, analysis->poppedValue(PC, 2));
analyze::CrossSSAValue indexv(a->inlineIndex, analysis->poppedValue(PC, 1));
bool hoisted = loop && loop->hoistArrayLengthCheck(objv, indexv);
bool hoisted = loop && id->isType(JSVAL_TYPE_INT32) &&
loop->hoistArrayLengthCheck(objv, indexv);
if (hoisted) {
FrameEntry *slotsFe = loop->invariantSlots(objv);
@ -1417,7 +1418,8 @@ mjit::Compiler::jsop_getelem_dense(bool isPacked)
analyze::CrossSSAValue objv(a->inlineIndex, analysis->poppedValue(PC, 1));
analyze::CrossSSAValue indexv(a->inlineIndex, analysis->poppedValue(PC, 0));
bool hoisted = loop && loop->hoistArrayLengthCheck(objv, indexv);
bool hoisted = loop && id->isType(JSVAL_TYPE_INT32) &&
loop->hoistArrayLengthCheck(objv, indexv);
// Get a register with either the object or its slots, depending on whether
// we are hoisting the bounds check.

15
js/src/methodjit/LoopState.cpp
View File

@ -505,6 +505,10 @@ LoopState::setLoopReg(AnyRegisterID reg, FrameEntry *fe)
bool
LoopState::hoistArrayLengthCheck(const CrossSSAValue &obj, const CrossSSAValue &index)
{
/*
* Note: this method requires that obj is either a dense array or not an
* object, and that the index is definitely an integer.
*/
if (skipAnalysis)
return false;
@ -1333,11 +1337,6 @@ LoopState::getLoopTestAccess(const SSAValue &v, uint32 *pslot, int32 *pconstant)
if (outerAnalysis->slotEscapes(slot))
return false;
/* Only consider tests on known integers. */
TypeSet *types = outerAnalysis->pushedTypes(pc, 0);
if (types->getKnownTypeTag(cx) != JSVAL_TYPE_INT32)
return false;
*pslot = slot;
if (cs->format & JOF_POST) {
if (cs->format & JOF_INC)
@ -1394,6 +1393,12 @@ LoopState::analyzeLoopTest()
SSAValue one = outerAnalysis->poppedValue(test.pushedOffset(), 1);
SSAValue two = outerAnalysis->poppedValue(test.pushedOffset(), 0);
/* The test must be comparing known integers. */
if (outerAnalysis->getValueTypes(one)->getKnownTypeTag(cx) != JSVAL_TYPE_INT32 ||
outerAnalysis->getValueTypes(two)->getKnownTypeTag(cx) != JSVAL_TYPE_INT32) {
return;
}
/* Reverse the condition if the RHS is modified by the loop. */
uint32 swapRHS;
int32 swapConstant;