Title: [142554] trunk/Source/_javascript_Core
- Revision
- 142554
- Author
- [email protected]
- Date
- 2013-02-11 17:05:39 -0800 (Mon, 11 Feb 2013)
Log Message
Unreviewed, adding a FIXME to remind ourselves of a bug.
https://bugs.webkit.org/show_bug.cgi?id=109487
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (142553 => 142554)
--- trunk/Source/_javascript_Core/ChangeLog 2013-02-12 00:55:07 UTC (rev 142553)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-02-12 01:05:39 UTC (rev 142554)
@@ -1,5 +1,13 @@
2013-02-11 Filip Pizlo <[email protected]>
+ Unreviewed, adding a FIXME to remind ourselves of a bug.
+ https://bugs.webkit.org/show_bug.cgi?id=109487
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
+
+2013-02-11 Filip Pizlo <[email protected]>
+
Strange bug in DFG OSR in JSC
https://bugs.webkit.org/show_bug.cgi?id=109491
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (142553 => 142554)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-02-12 00:55:07 UTC (rev 142553)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-02-12 01:05:39 UTC (rev 142554)
@@ -3404,6 +3404,10 @@
{
JSValueOperand op1(this, value);
+ // FIXME: This code is wrong for the case that the constant is null or undefined,
+ // and the value is an object that MasqueradesAsUndefined.
+ // https://bugs.webkit.org/show_bug.cgi?id=109487
+
unsigned branchIndexInBlock = detectPeepHoleBranch();
if (branchIndexInBlock != UINT_MAX) {
Node* branchNode = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
