Changeset 284699 in webkit

Timestamp:

Oct 22, 2021, 11:23:09 AM (5 years ago)

Author:

sbarati@apple.com

Message:

canDoFastSpread should also check that the Structure is from the global object we're watching
​https://bugs.webkit.org/show_bug.cgi?id=231976
<rdar://84340372>

Reviewed by Keith Miller.

Just reorder the checks for clarity.

• dfg/DFGGraph.cpp:

(JSC::DFG::Graph::canDoFastSpread):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGGraph.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-10-22  Saam Barati  <sbarati@apple.com>
+
+        canDoFastSpread should also check that the Structure is from the global object we're watching
+        https://bugs.webkit.org/show_bug.cgi?id=231976
+        <rdar://84340372>
+
+        Reviewed by Keith Miller.
+
+        Just reorder the checks for clarity.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::canDoFastSpread):
+
 2021-10-22  Robin Morisset  <rmorisset@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp

@@ -1848 +1848 @@
     bool allGood = true;
     value.m_structure.forEach([&] (RegisteredStructure structure) {
-        allGood &= structure->hasMonoProto()
-            && structure->globalObject() == globalObject
+        allGood &= structure->globalObject() == globalObject 
+            && structure->hasMonoProto()
             && structure->storedPrototype() == arrayPrototype
             && !structure->isDictionary()