Title: [124821] branches/safari-536.26-branch/Source/_javascript_Core
Revision
124821
Author
lforsch...@apple.com
Date
2012-08-06 17:14:00 -0700 (Mon, 06 Aug 2012)

Log Message

Merge <rdar://problem/11781190>

Modified Paths


Diff

Modified: branches/safari-536.26-branch/Source/_javascript_Core/ChangeLog (124820 => 124821)


--- branches/safari-536.26-branch/Source/_javascript_Core/ChangeLog	2012-08-07 00:00:32 UTC (rev 124820)
+++ branches/safari-536.26-branch/Source/_javascript_Core/ChangeLog	2012-08-07 00:14:00 UTC (rev 124821)
@@ -1,3 +1,17 @@
+2012-08-06  Lucas Forschler  <lforsch...@apple.com>
+
+    Merge patch for <rdar://problem/11781190>
+    
+    2012-07-24  Filip Pizlo  <fpi...@apple.com>
+
+        DFG method checks should keep the receiver of the property access alive until all checks complete.
+        <rdar://problem/11781190>
+    
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
 2012-08-02  Lucas Forschler  <lforsch...@apple.com>
 
     Merge 121307

Modified: branches/safari-536.26-branch/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (124820 => 124821)


--- branches/safari-536.26-branch/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp	2012-08-07 00:00:32 UTC (rev 124820)
+++ branches/safari-536.26-branch/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp	2012-08-07 00:14:00 UTC (rev 124821)
@@ -1935,6 +1935,9 @@
                 if (methodCallStatus.needsPrototypeCheck())
                     addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(methodCallStatus.prototypeStructure())), cellConstant(methodCallStatus.prototype()));
                 
+                // Keep the base of the access alive past the speculations.
+                addToGraph(Phantom, base);
+                
                 set(getInstruction[1].u.operand, cellConstant(methodCallStatus.function()));
             } else
                 set(getInstruction[1].u.operand, addToGraph(getByIdStatus.makesCalls() ? GetByIdFlush : GetById, OpInfo(identifier), OpInfo(prediction), base));
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to