diff options
| author | Filip Pizlo <fpizlo@apple.com> | 2014-09-24 18:43:29 +0200 |
|---|---|---|
| committer | Allan Sandfeld Jensen <allan.jensen@digia.com> | 2014-09-24 19:35:51 +0200 |
| commit | f69ddfaa6d06e0c209365835ad7590e9c18f5103 (patch) | |
| tree | 5b20c755263f0778dc583c56093287752a110217 /Source/JavaScriptCore/dfg/DFGCSEPhase.cpp | |
| parent | 3df57f7e550a19cb4450ed3896aa51ddb38c2ed2 (diff) | |
| download | qtwebkit-f69ddfaa6d06e0c209365835ad7590e9c18f5103.tar.gz | |
Incorrect behavior on emscripten-compiled cube2hash
https://bugs.webkit.org/show_bug.cgi?id=120033
Source/JavaScriptCore:
Reviewed by Mark Hahnenberg.
If PutClosureVar is may-aliased to another PutClosureVar or GetClosureVar
then we should bail attempts to CSE.
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::scopedVarLoadElimination):
(JSC::DFG::CSEPhase::scopedVarStoreElimination):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154344 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Task-number: QTBUG-41500
Change-Id: Ia6bd7b09b20a99d5f4b5a14bf58737bc4b8c6a2b
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Diffstat (limited to 'Source/JavaScriptCore/dfg/DFGCSEPhase.cpp')
| -rw-r--r-- | Source/JavaScriptCore/dfg/DFGCSEPhase.cpp | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp index 47af696a0..0eb29fcaf 100644 --- a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp +++ b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp @@ -254,9 +254,11 @@ private: break; } case PutScopedVar: { - if (node->child2() == registers && node->varNumber() == varNumber) + if (node->varNumber() != varNumber) + break; + if (node->child2() == registers) return node->child3().node(); - break; + return 0; } case SetLocal: { VariableAccessData* variableAccessData = node->variableAccessData(); @@ -327,9 +329,11 @@ private: Node* node = m_currentBlock->at(i); switch (node->op()) { case PutScopedVar: { - if (node->child1() == scope && node->child2() == registers && node->varNumber() == varNumber) + if (node->varNumber() != varNumber) + break; + if (node->child1() == scope && node->child2() == registers) return node; - break; + return 0; } case GetScopedVar: { |