Title: [207211] branches/safari-602-branch/Source/_javascript_Core
- Revision
- 207211
- Author
- matthew_han...@apple.com
- Date
- 2016-10-12 01:41:54 -0700 (Wed, 12 Oct 2016)
Log Message
Merge r206955. rdar://problem/28216236
Modified Paths
Diff
Modified: branches/safari-602-branch/Source/_javascript_Core/ChangeLog (207210 => 207211)
--- branches/safari-602-branch/Source/_javascript_Core/ChangeLog 2016-10-12 08:41:51 UTC (rev 207210)
+++ branches/safari-602-branch/Source/_javascript_Core/ChangeLog 2016-10-12 08:41:54 UTC (rev 207211)
@@ -1,5 +1,24 @@
2016-10-12 Matthew Hanson <matthew_han...@apple.com>
+ Merge r206955. rdar://problem/28216236
+
+ 2016-10-08 Saam Barati <sbar...@apple.com>
+
+ HasIndexedProperty clobberize rule is wrong for Array::ForceOSRExit
+ https://bugs.webkit.org/show_bug.cgi?id=159942
+ <rdar://problem/27328836>
+
+ Reviewed by Filip Pizlo.
+
+ When HasIndexedProperty has a ForceOSRExit array mode, it should
+ report to write to side state, like the ForceOSRExit node, and the
+ other nodes with ForceOSRExit array mode.
+
+ * dfg/DFGClobberize.h:
+ (JSC::DFG::clobberize):
+
+2016-10-12 Matthew Hanson <matthew_han...@apple.com>
+
Merge r206472. rdar://problem/28545009
2016-09-27 Filip Pizlo <fpi...@apple.com>
Modified: branches/safari-602-branch/Source/_javascript_Core/dfg/DFGClobberize.h (207210 => 207211)
--- branches/safari-602-branch/Source/_javascript_Core/dfg/DFGClobberize.h 2016-10-12 08:41:51 UTC (rev 207210)
+++ branches/safari-602-branch/Source/_javascript_Core/dfg/DFGClobberize.h 2016-10-12 08:41:54 UTC (rev 207211)
@@ -236,6 +236,10 @@
read(JSObject_butterfly);
ArrayMode mode = node->arrayMode();
switch (mode.type()) {
+ case Array::ForceExit: {
+ write(SideState);
+ return;
+ }
case Array::Int32: {
if (mode.isInBounds()) {
read(Butterfly_publicLength);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
