Changeset 220890 in webkit for trunk/Source/JavaScriptCore/jit/JITOperations.cpp

Timestamp:

Aug 17, 2017, 5:19:39 PM (8 years ago)

Author:

[email protected]

Message:

Teach DFGFixupPhase.cpp that the current scope is always a cell
​https://bugs.webkit.org/show_bug.cgi?id=175610

Patch by Robin Morisset <​[email protected]> on 2017-08-17
Reviewed by Keith Miller.

Also teach it that the argument to with can usually be speculated to be an object,
since toObject() is called on it.

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compilePushWithScope):

• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callOperation):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compilePushWithScope):

• jit/JITOperations.cpp:
• jit/JITOperations.h:

File:

• trunk/Source/JavaScriptCore/jit/JITOperations.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/jit/JITOperations.cpp

@@ -2011 +2011 @@
 }
 
+JSCell* JIT_OPERATION operationPushWithScopeObject(ExecState* exec, JSCell* currentScopeCell, JSObject* object)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    JSScope* currentScope = jsCast<JSScope*>(currentScopeCell);
+    return JSWithScope::create(vm, exec->lexicalGlobalObject(), currentScope, object);
+}
+
 EncodedJSValue JIT_OPERATION operationInstanceOf(ExecState* exec, EncodedJSValue encodedValue, EncodedJSValue encodedProto)
 {