Changeset 172405 in webkit for trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

Timestamp:

Aug 11, 2014, 1:00:58 PM (11 years ago)

Author:

[email protected]

Message:

Unreviewed, rolling out r172401.
​https://bugs.webkit.org/show_bug.cgi?id=135812

Failing stress/for-in-tests.js
​http://build.webkit.org/builders/Apple%20Mavericks%20Release%20WK1%20%28Tests%29/builds/7945/steps
/jscore-test/logs/stdio (Requested by mlam on #webkit).

Reverted changeset:

"for-in optimization should also make sure the base matches
the object being iterated"
​https://bugs.webkit.org/show_bug.cgi?id=135782
​http://trac.webkit.org/changeset/172401

File:

• trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -2045 +2045 @@
         this->emitLoopHeader(generator, propertyName.get());
 
-        generator.pushIndexedForInScope(base.get(), local.get(), i.get());
+        generator.pushIndexedForInScope(local.get(), i.get());
         generator.emitNode(dst, m_statement);
         generator.popIndexedForInScope(local.get());
@@ -2079 +2079 @@
         this->emitLoopHeader(generator, propertyName.get());
 
-        generator.pushStructureForInScope(base.get(), local.get(), i.get(), propertyName.get(), structureEnumerator.get());
+        generator.pushStructureForInScope(local.get(), i.get(), propertyName.get(), structureEnumerator.get());
         generator.emitNode(dst, m_statement);
         generator.popStructureForInScope(local.get());