Title: [215460] trunk/Source/_javascript_Core
- Revision
- 215460
- Author
- [email protected]
- Date
- 2017-04-18 08:39:47 -0700 (Tue, 18 Apr 2017)
Log Message
Unreviewed, follow-up patch after r215459
https://bugs.webkit.org/show_bug.cgi?id=170940
Reviewed by Filip Pizlo.
CheckCell can cause OSRExit. Thus Phantom should be placed after CheckCell.
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::emitFunctionChecks):
(JSC::DFG::ByteCodeParser::handleGetById):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (215459 => 215460)
--- trunk/Source/_javascript_Core/ChangeLog 2017-04-18 15:04:57 UTC (rev 215459)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-04-18 15:39:47 UTC (rev 215460)
@@ -1,5 +1,18 @@
2017-04-18 Yusuke Suzuki <[email protected]>
+ Unreviewed, follow-up patch after r215459
+ https://bugs.webkit.org/show_bug.cgi?id=170940
+
+ Reviewed by Filip Pizlo.
+
+ CheckCell can cause OSRExit. Thus Phantom should be placed after CheckCell.
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::emitFunctionChecks):
+ (JSC::DFG::ByteCodeParser::handleGetById):
+
+2017-04-18 Yusuke Suzuki <[email protected]>
+
[DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking for Array iterator object
https://bugs.webkit.org/show_bug.cgi?id=170940
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (215459 => 215460)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2017-04-18 15:04:57 UTC (rev 215459)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2017-04-18 15:39:47 UTC (rev 215460)
@@ -1383,9 +1383,9 @@
}
ASSERT(calleeCell);
+ addToGraph(CheckCell, OpInfo(m_graph.freeze(calleeCell)), callTargetForCheck);
if (thisArgument)
addToGraph(Phantom, thisArgument);
- addToGraph(CheckCell, OpInfo(m_graph.freeze(calleeCell)), callTargetForCheck);
}
Node* ByteCodeParser::getArgumentCount()
@@ -3614,8 +3614,8 @@
if (handleIntrinsicGetter(destinationOperand, variant, base,
[&] () {
+ addToGraph(CheckCell, OpInfo(m_graph.freeze(variant.intrinsicFunction())), getter);
addToGraph(Phantom, base);
- addToGraph(CheckCell, OpInfo(m_graph.freeze(variant.intrinsicFunction())), getter);
})) {
addToGraph(Phantom, getter);
return;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
