Title: [129553] trunk/Source/_javascript_Core
Revision
129553
Author
[email protected]
Date
2012-09-25 14:01:00 -0700 (Tue, 25 Sep 2012)

Log Message

Structure check hoisting phase doesn't know about the side-effecting nature of Arrayify
https://bugs.webkit.org/show_bug.cgi?id=97537

Reviewed by Mark Hahnenberg.

No tests because if we use Arrayify then we also use PutByVal(BlankToXYZ), and the latter is
already known to be side-effecting. So this bug shouldn't have had any symptoms, as far as I
can tell.

* dfg/DFGStructureCheckHoistingPhase.cpp:
(JSC::DFG::StructureCheckHoistingPhase::run):

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (129552 => 129553)


--- trunk/Source/_javascript_Core/ChangeLog	2012-09-25 20:52:00 UTC (rev 129552)
+++ trunk/Source/_javascript_Core/ChangeLog	2012-09-25 21:01:00 UTC (rev 129553)
@@ -1,3 +1,17 @@
+2012-09-25  Filip Pizlo  <[email protected]>
+
+        Structure check hoisting phase doesn't know about the side-effecting nature of Arrayify
+        https://bugs.webkit.org/show_bug.cgi?id=97537
+
+        Reviewed by Mark Hahnenberg.
+
+        No tests because if we use Arrayify then we also use PutByVal(BlankToXYZ), and the latter is
+        already known to be side-effecting. So this bug shouldn't have had any symptoms, as far as I
+        can tell.
+
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
 2012-09-25  Gavin Barraclough  <[email protected]>
 
         Regression: put beyond vector length prefers prototype setters to sparse properties

Modified: trunk/Source/_javascript_Core/dfg/DFGStructureCheckHoistingPhase.cpp (129552 => 129553)


--- trunk/Source/_javascript_Core/dfg/DFGStructureCheckHoistingPhase.cpp	2012-09-25 20:52:00 UTC (rev 129552)
+++ trunk/Source/_javascript_Core/dfg/DFGStructureCheckHoistingPhase.cpp	2012-09-25 21:01:00 UTC (rev 129553)
@@ -315,6 +315,7 @@
                 case ResolveBase:
                 case ResolveBaseStrictPut:
                 case ResolveGlobal:
+                case Arrayify:
                     clobber(live);
                     break;
                     
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to