Changeset 129943 in webkit for trunk/Source/JavaScriptCore/dfg

Timestamp:

Sep 28, 2012, 1:38:40 PM (13 years ago)

Author:

[email protected]

Message:

DFGStructureHoistingPhase SetLocal assumes StructureTransitionWatchpoint has a structure set
​https://bugs.webkit.org/show_bug.cgi?id=97810

Reviewed by Mark Hahnenberg.

No tests because this can't happen in ToT: the structure check hoisting phase runs before any
CFA or folding, so the only StructureTransitionWatchpoints it will see are the ones inserted
by the parser. But the parser will only insert StructureTransitinWatchpoints on constants, which
will not be subject to SetLocals.

Still, it would be good to fix this in case things changed.

• dfg/DFGStructureCheckHoistingPhase.cpp:

(JSC::DFG::StructureCheckHoistingPhase::run):

File:

• trunk/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp

@@ -123 +123 @@
                             continue;
                         switch (subNode.op()) {
-                        case CheckStructure:
+                        case CheckStructure: {
+                            if (subNode.child1().index() != source)
+                                break;
+                            
+                            noticeStructureCheck(variable, subNode.structureSet());
+                            break;
+                        }
                         case StructureTransitionWatchpoint: {
                             if (subNode.child1().index() != source)
                                 break;
                             
-                            noticeStructureCheck(variable, subNode.structureSet());
+                            noticeStructureCheck(variable, subNode.structure());
                             break;
                         }