Title: [153674] trunk/Source/_javascript_Core
- Revision
- 153674
- Author
- oli...@apple.com
- Date
- 2013-08-02 15:38:28 -0700 (Fri, 02 Aug 2013)
Log Message
Incorrect type speculation reported by ToPrimitive
https://bugs.webkit.org/show_bug.cgi?id=119458
Reviewed by Mark Hahnenberg.
Make sure that we report the correct type possibilities for the output
from ToPrimitive
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (153673 => 153674)
--- trunk/Source/_javascript_Core/ChangeLog 2013-08-02 22:30:48 UTC (rev 153673)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-08-02 22:38:28 UTC (rev 153674)
@@ -1,3 +1,16 @@
+2013-08-02 Oliver Hunt <oli...@apple.com>
+
+ Incorrect type speculation reported by ToPrimitive
+ https://bugs.webkit.org/show_bug.cgi?id=119458
+
+ Reviewed by Mark Hahnenberg.
+
+ Make sure that we report the correct type possibilities for the output
+ from ToPrimitive
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::::executeEffects):
+
2013-08-02 Gavin Barraclough <barraclo...@apple.com>
Remove no-arguments constructor to PropertySlot
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (153673 => 153674)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2013-08-02 22:30:48 UTC (rev 153673)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2013-08-02 22:38:28 UTC (rev 153674)
@@ -982,10 +982,9 @@
clobberWorld(node->codeOrigin, clobberLimit);
SpeculatedType type = source.m_type;
- if (type & ~(SpecNumber | SpecString | SpecBoolean)) {
- type &= (SpecNumber | SpecString | SpecBoolean);
- type |= SpecString;
- }
+ if (type & ~(SpecNumber | SpecString | SpecBoolean))
+ type = (SpecTop & ~SpecCell) | SpecString;
+
destination.setType(type);
if (destination.isClear())
m_state.setIsValid(false);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
