Changeset 192949 in webkit for trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

Timestamp:

Dec 2, 2015, 11:15:33 AM (10 years ago)

Author:

[email protected]

Message:

Teach DFG that ArithSub can now clobber the heap (and other things).
​https://bugs.webkit.org/show_bug.cgi?id=151733

Reviewed by Geoffrey Garen.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

File:

• trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

@@ -529 +529 @@
             break;
         case UntypedUse:
-            forNode(node).setType(m_graph, SpecHeapTop);
+            clobberWorld(node->origin.semantic, clobberLimit);
+            forNode(node).setType(m_graph, SpecBytecodeNumber);
             break;
         default: