Title: [206955] trunk/Source/_javascript_Core
- Revision
- 206955
- Author
- sbar...@apple.com
- Date
- 2016-10-08 11:32:12 -0700 (Sat, 08 Oct 2016)
Log Message
HasIndexedProperty clobberize rule is wrong for Array::ForceOSRExit
https://bugs.webkit.org/show_bug.cgi?id=159942
<rdar://problem/27328836>
Reviewed by Filip Pizlo.
When HasIndexedProperty has a ForceOSRExit array mode, it should
report to write to side state, like the ForceOSRExit node, and the
other nodes with ForceOSRExit array mode.
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (206954 => 206955)
--- trunk/Source/_javascript_Core/ChangeLog 2016-10-08 14:49:47 UTC (rev 206954)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-10-08 18:32:12 UTC (rev 206955)
@@ -1,3 +1,18 @@
+2016-10-08 Saam Barati <sbar...@apple.com>
+
+ HasIndexedProperty clobberize rule is wrong for Array::ForceOSRExit
+ https://bugs.webkit.org/show_bug.cgi?id=159942
+ <rdar://problem/27328836>
+
+ Reviewed by Filip Pizlo.
+
+ When HasIndexedProperty has a ForceOSRExit array mode, it should
+ report to write to side state, like the ForceOSRExit node, and the
+ other nodes with ForceOSRExit array mode.
+
+ * dfg/DFGClobberize.h:
+ (JSC::DFG::clobberize):
+
2016-10-07 Mark Lam <mark....@apple.com>
Object.freeze() and seal() should throw if [[PreventExtensions]]() fails.
Modified: trunk/Source/_javascript_Core/dfg/DFGClobberize.h (206954 => 206955)
--- trunk/Source/_javascript_Core/dfg/DFGClobberize.h 2016-10-08 14:49:47 UTC (rev 206954)
+++ trunk/Source/_javascript_Core/dfg/DFGClobberize.h 2016-10-08 18:32:12 UTC (rev 206955)
@@ -262,6 +262,10 @@
read(JSObject_butterfly);
ArrayMode mode = node->arrayMode();
switch (mode.type()) {
+ case Array::ForceExit: {
+ write(SideState);
+ return;
+ }
case Array::Int32: {
if (mode.isInBounds()) {
read(Butterfly_publicLength);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
