Title: [225170] trunk/Source/_javascript_Core
- Revision
- 225170
- Author
- rmoris...@apple.com
- Date
- 2017-11-27 08:22:54 -0800 (Mon, 27 Nov 2017)
Log Message
Update DFGSafeToExecute to be aware that ArrayPush is now a varargs node
https://bugs.webkit.org/show_bug.cgi?id=179821
Reviewed by Saam Barati.
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (225169 => 225170)
--- trunk/Source/_javascript_Core/ChangeLog 2017-11-27 16:02:24 UTC (rev 225169)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-11-27 16:22:54 UTC (rev 225170)
@@ -1,3 +1,13 @@
+2017-11-27 Robin Morisset <rmoris...@apple.com>
+
+ Update DFGSafeToExecute to be aware that ArrayPush is now a varargs node
+ https://bugs.webkit.org/show_bug.cgi?id=179821
+
+ Reviewed by Saam Barati.
+
+ * dfg/DFGSafeToExecute.h:
+ (JSC::DFG::safeToExecute):
+
2017-11-21 Yusuke Suzuki <utatane....@gmail.com>
[DFG] Add NormalizeMapKey DFG IR
Modified: trunk/Source/_javascript_Core/dfg/DFGSafeToExecute.h (225169 => 225170)
--- trunk/Source/_javascript_Core/dfg/DFGSafeToExecute.h 2017-11-27 16:02:24 UTC (rev 225169)
+++ trunk/Source/_javascript_Core/dfg/DFGSafeToExecute.h 2017-11-27 16:22:54 UTC (rev 225170)
@@ -465,12 +465,14 @@
case GetIndexedPropertyStorage:
case GetArrayLength:
case GetVectorLength:
- case ArrayPush:
case ArrayPop:
case StringCharAt:
case StringCharCodeAt:
return node->arrayMode().alreadyChecked(graph, node, state.forNode(node->child1()));
-
+
+ case ArrayPush:
+ return node->arrayMode().alreadyChecked(graph, node, state.forNode(graph.varArgChild(node, 1)));
+
case GetTypedArrayByteOffset:
return !(state.forNode(node->child1()).m_type & ~(SpecTypedArrayView));
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
