Title: [227053] trunk
- Revision
- 227053
- Author
- sbar...@apple.com
- Date
- 2018-01-17 01:24:26 -0800 (Wed, 17 Jan 2018)
Log Message
DFG::Node::convertToConstant needs to clear the varargs flags
https://bugs.webkit.org/show_bug.cgi?id=181697
<rdar://problem/36497332>
Reviewed by Yusuke Suzuki.
JSTests:
* stress/dfg-node-convert-to-constant-must-clear-varargs-flags.js: Added.
(doIndexOf):
(bar):
(i.bar):
Source/_javascript_Core:
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToConstant):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (227052 => 227053)
--- trunk/JSTests/ChangeLog 2018-01-17 09:22:35 UTC (rev 227052)
+++ trunk/JSTests/ChangeLog 2018-01-17 09:24:26 UTC (rev 227053)
@@ -1,3 +1,16 @@
+2018-01-17 Saam Barati <sbar...@apple.com>
+
+ DFG::Node::convertToConstant needs to clear the varargs flags
+ https://bugs.webkit.org/show_bug.cgi?id=181697
+ <rdar://problem/36497332>
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/dfg-node-convert-to-constant-must-clear-varargs-flags.js: Added.
+ (doIndexOf):
+ (bar):
+ (i.bar):
+
2018-01-16 Ryan Haddad <ryanhad...@apple.com>
Unreviewed, rolling out r226937.
Added: trunk/JSTests/stress/dfg-node-convert-to-constant-must-clear-varargs-flags.js (0 => 227053)
--- trunk/JSTests/stress/dfg-node-convert-to-constant-must-clear-varargs-flags.js (rev 0)
+++ trunk/JSTests/stress/dfg-node-convert-to-constant-must-clear-varargs-flags.js 2018-01-17 09:24:26 UTC (rev 227053)
@@ -0,0 +1,14 @@
+function doIndexOf(a) {
+ a.indexOf(a);
+}
+
+function bar(f) {
+ f();
+}
+
+let array = [20];
+for (let i = 0; i < 100000; ++i) {
+ bar(() => {
+ return doIndexOf(array.concat());
+ });
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (227052 => 227053)
--- trunk/Source/_javascript_Core/ChangeLog 2018-01-17 09:22:35 UTC (rev 227052)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-01-17 09:24:26 UTC (rev 227053)
@@ -1,3 +1,14 @@
+2018-01-17 Saam Barati <sbar...@apple.com>
+
+ DFG::Node::convertToConstant needs to clear the varargs flags
+ https://bugs.webkit.org/show_bug.cgi?id=181697
+ <rdar://problem/36497332>
+
+ Reviewed by Yusuke Suzuki.
+
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::convertToConstant):
+
2018-01-16 JF Bastien <jfbast...@apple.com>
Allow dangerous disabling of poison
Modified: trunk/Source/_javascript_Core/dfg/DFGNode.h (227052 => 227053)
--- trunk/Source/_javascript_Core/dfg/DFGNode.h 2018-01-17 09:22:35 UTC (rev 227052)
+++ trunk/Source/_javascript_Core/dfg/DFGNode.h 2018-01-17 09:24:26 UTC (rev 227053)
@@ -518,7 +518,7 @@
m_op = Int52Constant;
else
m_op = JSConstant;
- m_flags &= ~NodeMustGenerate;
+ m_flags &= ~(NodeMustGenerate | NodeHasVarArgs);
m_opInfo = value;
children.reset();
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
