Changeset 103594 in webkit for trunk/Source/JavaScriptCore/dfg/DFGAbstractState.cpp

Timestamp:

Dec 22, 2011, 4:27:39 PM (13 years ago)

Author:

[email protected]

Message:

DFG CFA sometimes generates an incorrect proof that a node is known to be a typed array
​https://bugs.webkit.org/show_bug.cgi?id=75150
<rdar://problem/10621900>

Reviewed by Gavin Barraclough.

Source/JavaScriptCore:

• dfg/DFGAbstractState.cpp:

(JSC::DFG::AbstractState::execute):

LayoutTests:

• fast/js/dfg-float32array-expected.txt: Added.
• fast/js/dfg-float32array.html: Added.
• fast/js/dfg-int32array-expected.txt: Added.
• fast/js/dfg-int32array.html: Added.
• fast/js/script-tests/dfg-float32array.js: Added.

(getter1):
(setter1):
(getter2):
(setter2):
(getter3):
(setter3):
(getter4):
(setter4):
(getters.getter1.a):
(.a):
(setters.setter1.a):
(safeGetter):
(safeSetter):

• fast/js/script-tests/dfg-int32array.js: Added.

(getter1):
(setter1):
(getter2):
(setter2):
(getter3):
(setter3):
(getter4):
(setter4):
(getters.getter1.a):
(.a):
(setters.setter1.a):
(safeGetter):
(safeSetter):

File:

• trunk/Source/JavaScriptCore/dfg/DFGAbstractState.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGAbstractState.cpp

@@ -221 +221 @@
         else if (isByteArrayPrediction(predictedType))
             forNode(node.child1()).filter(PredictByteArray);
-        else if (isInt8ArrayPrediction(predictedType))
-            forNode(node.child1()).filter(PredictInt8Array);
-        else if (isInt16ArrayPrediction(predictedType))
-            forNode(node.child1()).filter(PredictInt16Array);
-        else if (isInt32ArrayPrediction(predictedType))
-            forNode(node.child1()).filter(PredictInt32Array);
-        else if (isUint8ArrayPrediction(predictedType))
-            forNode(node.child1()).filter(PredictUint8Array);
-        else if (isUint16ArrayPrediction(predictedType))
-            forNode(node.child1()).filter(PredictUint16Array);
-        else if (isUint32ArrayPrediction(predictedType))
-            forNode(node.child1()).filter(PredictUint32Array);
-        else if (isFloat32ArrayPrediction(predictedType))
-            forNode(node.child1()).filter(PredictFloat32Array);
-        else if (isFloat64ArrayPrediction(predictedType))
-            forNode(node.child1()).filter(PredictFloat64Array);
         else if (isBooleanPrediction(predictedType))
             forNode(node.child1()).filter(PredictBoolean);