Title: [161587] tags/Safari-538.10.2/Source/_javascript_Core
- Revision
- 161587
- Author
- [email protected]
- Date
- 2014-01-09 14:51:49 -0800 (Thu, 09 Jan 2014)
Log Message
Merged r161574. <rdar://problem/15762689>
Modified Paths
Added Paths
Diff
Modified: tags/Safari-538.10.2/Source/_javascript_Core/ChangeLog (161586 => 161587)
--- tags/Safari-538.10.2/Source/_javascript_Core/ChangeLog 2014-01-09 22:49:15 UTC (rev 161586)
+++ tags/Safari-538.10.2/Source/_javascript_Core/ChangeLog 2014-01-09 22:51:49 UTC (rev 161587)
@@ -1,3 +1,19 @@
+2014-01-09 Lucas Forschler <[email protected]>
+
+ Merge r161574
+
+ 2014-01-09 Filip Pizlo <[email protected]>
+
+ AI for CreateArguments should pass through non-SpecEmpty input values
+ https://bugs.webkit.org/show_bug.cgi?id=126709
+
+ Reviewed by Mark Hahnenberg.
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * tests/stress/use-arguments-as-object-pointer.js: Added.
+ (foo):
+
2013-12-19 Mark Hahnenberg <[email protected]>
Put write barriers in the right places in the baseline JIT
Modified: tags/Safari-538.10.2/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (161586 => 161587)
--- tags/Safari-538.10.2/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2014-01-09 22:49:15 UTC (rev 161586)
+++ tags/Safari-538.10.2/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2014-01-09 22:51:49 UTC (rev 161587)
@@ -1152,7 +1152,9 @@
break;
case CreateArguments:
- forNode(node).setType(SpecArguments);
+ forNode(node) = forNode(node->child1());
+ forNode(node).filter(~SpecEmpty);
+ forNode(node).merge(SpecArguments);
break;
case TearOffActivation:
Copied: tags/Safari-538.10.2/Source/_javascript_Core/tests/stress/use-arguments-as-object-pointer.js (from rev 161574, trunk/Source/_javascript_Core/tests/stress/use-arguments-as-object-pointer.js) (0 => 161587)
--- tags/Safari-538.10.2/Source/_javascript_Core/tests/stress/use-arguments-as-object-pointer.js (rev 0)
+++ tags/Safari-538.10.2/Source/_javascript_Core/tests/stress/use-arguments-as-object-pointer.js 2014-01-09 22:51:49 UTC (rev 161587)
@@ -0,0 +1,13 @@
+function foo() {
+ arguments = {f:42};
+ return arguments.f;
+}
+
+noInline(foo);
+
+for (var i = 0; i < 100000; ++i) {
+ var result = foo();
+ if (result != 42)
+ throw "Error: bad result: " + result;
+}
+
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
