[webkit-reviews] review denied: [Bug 195279] DFG should not force KnownInt32 edges during fixup : [Attachment 363786] Patch
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Wed Mar 6 17:15:09 PST 2019
Saam Barati <sbarati at apple.com> has denied Tadeu Zagallo <tzagallo at apple.com>'s
request for review:
Bug 195279: DFG should not force KnownInt32 edges during fixup
https://bugs.webkit.org/show_bug.cgi?id=195279
Attachment 363786: Patch
https://bugs.webkit.org/attachment.cgi?id=363786&action=review
--- Comment #13 from Saam Barati <sbarati at apple.com> ---
Comment on attachment 363786
--> https://bugs.webkit.org/attachment.cgi?id=363786
Patch
View in context: https://bugs.webkit.org/attachment.cgi?id=363786&action=review
Are all the other nodes vetted? I think you still have that StrictInt32 crap
that needs to be removed for the EnumeratorPName.
> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:8562
> + JSValueOperand value(this, element,
ManualOperandSpeculation);
> + valueRegs = value.jsValueRegs();
> + }
You should remove the above if and just call speculate(...) here
> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4668
> + value = boxInt32(lowInt32(element));
just call: speculate(element)
You're still missing code for the elemntCount > 1 case
More information about the webkit-reviews
mailing list