Changeset 128425 in webkit for trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

Timestamp:

Sep 13, 2012, 1:40:00 AM (13 years ago)

Author:

[email protected]

Message:

Testing whether indexing type is ArrayWithArrayStorage should not compare against ArrayWithArrayStorage
​https://bugs.webkit.org/show_bug.cgi?id=96611

Reviewed by Gavin Barraclough.

• dfg/DFGRepatch.cpp:

(JSC::DFG::tryCacheGetByID):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::checkArray):

• jit/JITPropertyAccess.cpp:

(JSC::JIT::privateCompilePatchGetArrayLength):

• jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::privateCompilePatchGetArrayLength):

• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:

File:

• trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm (modified) (1 diff)

trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

@@ -1025 +1025 @@
         storep t2, ArrayProfile::m_lastSeenStructure[t1]
     end
-    bbneq Structure::m_indexingType[t2], IsArray | HasArrayStorage, .opGetArrayLengthSlow
+    loadb Structure::m_indexingType[t2], t1
+    btiz t1, IsArray, .opGetArrayLengthSlow
+    btiz t1, HasArrayStorage, .opGetArrayLengthSlow
     loadis 8[PB, PC, 8], t1
     loadp 64[PB, PC, 8], t2