Changeset 207211 in webkit

Timestamp:

Oct 12, 2016 1:41:54 AM (8 years ago)

Author:

matthew_hanson@apple.com

Message:

Merge r206955. rdar://problem/28216236

Location:

branches/safari-602-branch/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGClobberize.h (modified) (1 diff)

branches/safari-602-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-10-12  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r206955. rdar://problem/28216236
+
+    2016-10-08  Saam Barati  <sbarati@apple.com>
+
+            HasIndexedProperty clobberize rule is wrong for Array::ForceOSRExit
+            https://bugs.webkit.org/show_bug.cgi?id=159942
+            <rdar://problem/27328836>
+
+            Reviewed by Filip Pizlo.
+
+            When HasIndexedProperty has a ForceOSRExit array mode, it should
+            report to write to side state, like the ForceOSRExit node, and the
+            other nodes with ForceOSRExit array mode.
+
+            * dfg/DFGClobberize.h:
+            (JSC::DFG::clobberize):
+
 2016-10-12  Matthew Hanson  <matthew_hanson@apple.com>
 

branches/safari-602-branch/Source/JavaScriptCore/dfg/DFGClobberize.h

@@ -237 +237 @@
         ArrayMode mode = node->arrayMode();
         switch (mode.type()) {
+        case Array::ForceExit: {
+            write(SideState);
+            return;
+        }
         case Array::Int32: {
             if (mode.isInBounds()) {