Title: [199801] trunk/Source/_javascript_Core
- Revision
- 199801
- Author
- [email protected]
- Date
- 2016-04-20 19:35:29 -0700 (Wed, 20 Apr 2016)
Log Message
DFG del_by_id support forgets to set()
https://bugs.webkit.org/show_bug.cgi?id=156830
Reviewed by Saam Barati.
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* tests/stress/dfg-del-by-id.js: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (199800 => 199801)
--- trunk/Source/_javascript_Core/ChangeLog 2016-04-21 00:55:03 UTC (rev 199800)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-04-21 02:35:29 UTC (rev 199801)
@@ -1,3 +1,14 @@
+2016-04-20 Filip Pizlo <[email protected]>
+
+ DFG del_by_id support forgets to set()
+ https://bugs.webkit.org/show_bug.cgi?id=156830
+
+ Reviewed by Saam Barati.
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::parseBlock):
+ * tests/stress/dfg-del-by-id.js: Added.
+
2016-04-20 Saam barati <[email protected]>
Improve sampling profiler CLI JSC tool
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (199800 => 199801)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2016-04-21 00:55:03 UTC (rev 199800)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2016-04-21 02:35:29 UTC (rev 199801)
@@ -4044,7 +4044,8 @@
case op_del_by_id: {
Node* base = get(VirtualRegister(currentInstruction[2].u.operand));
unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[currentInstruction[3].u.operand];
- addToGraph(DeleteById, OpInfo(identifierNumber), base);
+ set(VirtualRegister(currentInstruction[1].u.operand),
+ addToGraph(DeleteById, OpInfo(identifierNumber), base));
NEXT_OPCODE(op_del_by_id);
}
Added: trunk/Source/_javascript_Core/tests/stress/dfg-del-by-id.js (0 => 199801)
--- trunk/Source/_javascript_Core/tests/stress/dfg-del-by-id.js (rev 0)
+++ trunk/Source/_javascript_Core/tests/stress/dfg-del-by-id.js 2016-04-21 02:35:29 UTC (rev 199801)
@@ -0,0 +1,14 @@
+function foo(o) {
+ return delete o.f;
+}
+
+noInline(foo);
+
+for (var i = 0; i < 10000; ++i) {
+ var o = {f:42};
+ var result = foo(o);
+ if (result !== true)
+ throw "Error: bad result: " + result;
+ if ("f" in o)
+ throw "Error: \"f\" still in ok";
+}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
