Changeset 129553 in webkit for trunk/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp

Timestamp:

Sep 25, 2012, 2:01:00 PM (13 years ago)

Author:

[email protected]

Message:

Structure check hoisting phase doesn't know about the side-effecting nature of Arrayify
​https://bugs.webkit.org/show_bug.cgi?id=97537

Reviewed by Mark Hahnenberg.

No tests because if we use Arrayify then we also use PutByVal(BlankToXYZ), and the latter is
already known to be side-effecting. So this bug shouldn't have had any symptoms, as far as I
can tell.

• dfg/DFGStructureCheckHoistingPhase.cpp:

(JSC::DFG::StructureCheckHoistingPhase::run):

File:

• trunk/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp

@@ -316 +316 @@
                 case ResolveBaseStrictPut:
                 case ResolveGlobal:
+                case Arrayify:
                     clobber(live);
                     break;