Changeset 206955 in webkit

Timestamp:

Oct 8, 2016 11:32:12 AM (8 years ago)

Author:

sbarati@apple.com

Message:

HasIndexedProperty clobberize rule is wrong for Array::ForceOSRExit
​https://bugs.webkit.org/show_bug.cgi?id=159942
<rdar://problem/27328836>

Reviewed by Filip Pizlo.

When HasIndexedProperty has a ForceOSRExit array mode, it should
report to write to side state, like the ForceOSRExit node, and the
other nodes with ForceOSRExit array mode.

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGClobberize.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-10-08  Saam Barati  <sbarati@apple.com>
+
+        HasIndexedProperty clobberize rule is wrong for Array::ForceOSRExit
+        https://bugs.webkit.org/show_bug.cgi?id=159942
+        <rdar://problem/27328836>
+
+        Reviewed by Filip Pizlo.
+
+        When HasIndexedProperty has a ForceOSRExit array mode, it should
+        report to write to side state, like the ForceOSRExit node, and the
+        other nodes with ForceOSRExit array mode.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+
 2016-10-07  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGClobberize.h

@@ -263 +263 @@
         ArrayMode mode = node->arrayMode();
         switch (mode.type()) {
+        case Array::ForceExit: {
+            write(SideState);
+            return;
+        }
         case Array::Int32: {
             if (mode.isInBounds()) {