Changeset 142695 in webkit for trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
- Timestamp:
- Feb 12, 2013, 5:25:27 PM (13 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
r142544 r142695 593 593 SpeculatedType prediction = node->child1()->prediction(); 594 594 if (prediction) { 595 if (prediction & ~SpecObject Mask) {596 prediction &= SpecObject Mask;595 if (prediction & ~SpecObject) { 596 prediction &= SpecObject; 597 597 prediction = mergeSpeculations(prediction, SpecObjectOther); 598 598 } … … 689 689 if (isObjectSpeculation(child)) { 690 690 // I'd love to fold this case into the case below, but I can't, because 691 // removing SpecObject Maskfrom something that only has an object691 // removing SpecObject from something that only has an object 692 692 // prediction and nothing else means we have an ill-formed SpeculatedType 693 693 // (strong predict-none). This should be killed once we remove all traces 694 694 // of static (aka weak) predictions. 695 695 changed |= mergePrediction(SpecString); 696 } else if (child & SpecObject Mask) {696 } else if (child & SpecObject) { 697 697 // Objects get turned into strings. So if the input has hints of objectness, 698 698 // the output will have hinsts of stringiness. 699 699 changed |= mergePrediction( 700 mergeSpeculations(child & ~SpecObject Mask, SpecString));700 mergeSpeculations(child & ~SpecObject, SpecString)); 701 701 } else 702 702 changed |= mergePrediction(child);
Note:
See TracChangeset
for help on using the changeset viewer.