Title: [161574] trunk/Source/_javascript_Core
- Revision
- 161574
- Author
- [email protected]
- Date
- 2014-01-09 12:41:06 -0800 (Thu, 09 Jan 2014)
Log Message
AI for CreateArguments should pass through non-SpecEmpty input values
https://bugs.webkit.org/show_bug.cgi?id=126709
Reviewed by Mark Hahnenberg.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* tests/stress/use-arguments-as-object-pointer.js: Added.
(foo):
Modified Paths
Added Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (161573 => 161574)
--- trunk/Source/_javascript_Core/ChangeLog 2014-01-09 20:30:33 UTC (rev 161573)
+++ trunk/Source/_javascript_Core/ChangeLog 2014-01-09 20:41:06 UTC (rev 161574)
@@ -1,3 +1,15 @@
+2014-01-09 Filip Pizlo <[email protected]>
+
+ AI for CreateArguments should pass through non-SpecEmpty input values
+ https://bugs.webkit.org/show_bug.cgi?id=126709
+
+ Reviewed by Mark Hahnenberg.
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * tests/stress/use-arguments-as-object-pointer.js: Added.
+ (foo):
+
2014-01-09 Mark Hahnenberg <[email protected]>
Constructors for Objective-C classes do not work properly with instanceof
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (161573 => 161574)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2014-01-09 20:30:33 UTC (rev 161573)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2014-01-09 20:41:06 UTC (rev 161574)
@@ -1327,7 +1327,9 @@
break;
case CreateArguments:
- forNode(node).setType(SpecArguments);
+ forNode(node) = forNode(node->child1());
+ forNode(node).filter(~SpecEmpty);
+ forNode(node).merge(SpecArguments);
break;
case TearOffActivation:
Added: trunk/Source/_javascript_Core/tests/stress/use-arguments-as-object-pointer.js (0 => 161574)
--- trunk/Source/_javascript_Core/tests/stress/use-arguments-as-object-pointer.js (rev 0)
+++ trunk/Source/_javascript_Core/tests/stress/use-arguments-as-object-pointer.js 2014-01-09 20:41:06 UTC (rev 161574)
@@ -0,0 +1,13 @@
+function foo() {
+ arguments = {f:42};
+ return arguments.f;
+}
+
+noInline(foo);
+
+for (var i = 0; i < 100000; ++i) {
+ var result = foo();
+ if (result != 42)
+ throw "Error: bad result: " + result;
+}
+
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
