Bug 128892

Summary: FTL should support ToPrimitive and the DFG should fold it correctly
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: barraclough, ggaren, mark.lam, mhahnenberg, mmirman, msaboff, nrotem, oliver, sam
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Bug Depends on:    
Bug Blocks: 112840    
Attachments:
Description Flags
the patch ggaren: review+

Filip Pizlo
Reported 2014-02-16 23:13:58 PST
Patch forthcoming.
Attachments
the patch (8.19 KB, patch)
2014-02-16 23:15 PST, Filip Pizlo 		ggaren: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2014-02-16 23:15:25 PST
Created attachment 224334 [details] the patch
Geoffrey Garen
Comment 2 2014-02-17 09:30:52 PST
Comment on attachment 224334 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=224334&action=review r=me > Source/JavaScriptCore/ChangeLog:3 > + FTL should support ToPrimitive and the DFG should fold it in a less dumb way Let's just say "better". > Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:-331 > - case StoreBarrier: > - case StoreBarrierWithNullCheck: { What happened to store barrier?
Mark Hahnenberg
Comment 3 2014-02-17 09:36:00 PST
Comment on attachment 224334 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=224334&action=review >> Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:-331 >> - case StoreBarrierWithNullCheck: { > > What happened to store barrier? Looks like they weren't doing anything and could therefore fall through to the default case.
Filip Pizlo
Comment 4 2014-02-17 10:30:34 PST
(In reply to comment #2) > (From update of attachment 224334 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=224334&action=review > > r=me > > > Source/JavaScriptCore/ChangeLog:3 > > + FTL should support ToPrimitive and the DFG should fold it in a less dumb way > > Let's just say "better". > > > Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:-331 > > - case StoreBarrier: > > - case StoreBarrierWithNullCheck: { > > What happened to store barrier? Nothing, since this was redundant with the default case.
Filip Pizlo
Comment 5 2014-02-17 12:18:32 PST
Landed in http://trac.webkit.org/changeset/164243
Note You need to log in before you can comment on or make changes to this bug.