Changeset 176972 in webkit for trunk/Source/JavaScriptCore/dfg/DFGArrayMode.h

Timestamp:

Dec 8, 2014, 2:12:25 PM (10 years ago)

Author:

[email protected]

Message:

CFA wrongly assumes that a speculation for SlowPutArrayStorageShape disallows ArrayStorageShape arrays.
<​https://webkit.org/b/139327>

Reviewed by Michael Saboff.

Source/JavaScriptCore:

The code generator and runtime slow paths expects otherwise. This patch fixes
CFA to match the code generator's expectation.

• dfg/DFGArrayMode.h:

(JSC::DFG::ArrayMode::arrayModesThatPassFiltering):
(JSC::DFG::ArrayMode::arrayModesWithIndexingShapes):

LayoutTests:

• js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage-expected.txt: Added.
• js/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.html: Added.
• js/script-tests/dfg-slow-put-array-storage-spec-should-allow-fast-array-storage.js: Added.

(foo):
(test):

File:

• trunk/Source/JavaScriptCore/dfg/DFGArrayMode.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGArrayMode.h

@@ -407 +407 @@
             return arrayModesWithIndexingShape(ArrayStorageShape);
         case Array::SlowPutArrayStorage:
-            return arrayModesWithIndexingShape(SlowPutArrayStorageShape);
+            return arrayModesWithIndexingShapes(SlowPutArrayStorageShape, ArrayStorageShape);
         default:
             return asArrayModes(NonArray);
@@ -463 +463 @@
     }
     
+    ArrayModes arrayModesWithIndexingShapes(IndexingType shape1, IndexingType shape2) const
+    {
+        ArrayModes arrayMode1 = arrayModesWithIndexingShape(shape1);
+        ArrayModes arrayMode2 = arrayModesWithIndexingShape(shape2);
+        return arrayMode1 | arrayMode2;
+    }
+
     bool alreadyChecked(Graph&, Node*, AbstractValue&, IndexingType shape) const;