Changeset 107496 in webkit for trunk/Source/JavaScriptCore/dfg/DFGAbstractState.cpp

Timestamp:

Feb 11, 2012, 6:26:06 PM (14 years ago)

Author:

[email protected]

Message:

DFG CFA assumes that a WeakJSConstant's structure is known
​https://bugs.webkit.org/show_bug.cgi?id=78428
<rdar://problem/10849492> <rdar://problem/10849621>

Source/JavaScriptCore:

Reviewed by Gavin Barraclough.

• dfg/DFGAbstractState.cpp:

(JSC::DFG::AbstractState::execute):

LayoutTests:

Rubber stamped by Gavin Barraclough.

• fast/js/dfg-put-by-id-prototype-check-expected.txt: Added.
• fast/js/dfg-put-by-id-prototype-check.html: Added.
• fast/js/script-tests/dfg-put-by-id-prototype-check.js: Added.

(foo):
(Foo):

File:

• trunk/Source/JavaScriptCore/dfg/DFGAbstractState.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGAbstractState.cpp

@@ -198 +198 @@
     case WeakJSConstant: {
         JSValue value = m_graph.valueOfJSConstant(m_codeBlock, nodeIndex);
-        if (value.isCell())
-            m_haveStructures = true;
-        forNode(nodeIndex).set(value);
+        // Have to be careful here! It's tempting to call set(value), but
+        // that would be wrong, since that would constitute a proof that this
+        // value will always have the same structure. The whole point of a value
+        // having a structure is that it may change in the future - for example
+        // between when we compile the code and when we run it.
+        forNode(nodeIndex).set(predictionFromValue(value));
         break;
     }