Changeset 228401 in webkit for trunk/Source/JavaScriptCore/dfg/DFGArgumentsUtilities.cpp

Timestamp:

Feb 12, 2018, 3:41:17 PM (7 years ago)

Author:

[email protected]

Message:

DFG::emitCodeToGetArgumentsArrayLength needs to handle NewArrayBuffer/PhantomNewArrayBuffer
​https://bugs.webkit.org/show_bug.cgi?id=182706
<rdar://problem/36833681>

Reviewed by Filip Pizlo.

JSTests:

• stress/get-array-length-phantom-new-array-buffer.js: Added.

(effects):
(foo):

Source/JavaScriptCore:

When we added support for PhantomNewArrayBuffer, we forgot to update
the emitCodeToGetArgumentsArrayLength function to handle PhantomNewArrayBuffer.
This patch adds that support. It's trivial to generate the length for
a PhantomNewArrayBuffer node since it's a constant buffer, with a constant
length.

• dfg/DFGArgumentsUtilities.cpp:

(JSC::DFG::emitCodeToGetArgumentsArrayLength):

File:

• trunk/Source/JavaScriptCore/dfg/DFGArgumentsUtilities.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGArgumentsUtilities.cpp

@@ -66 +66 @@
         graph, arguments,
         arguments->op() == CreateDirectArguments || arguments->op() == CreateScopedArguments
-        || arguments->op() == CreateClonedArguments || arguments->op() == CreateRest
-        || arguments->op() == PhantomDirectArguments || arguments->op() == PhantomClonedArguments || arguments->op() == PhantomCreateRest,
+        || arguments->op() == CreateClonedArguments || arguments->op() == CreateRest || arguments->op() == NewArrayBuffer
+        || arguments->op() == PhantomDirectArguments || arguments->op() == PhantomClonedArguments
+        || arguments->op() == PhantomCreateRest || arguments->op() == PhantomNewArrayBuffer,
         arguments->op());
+
+    if (arguments->op() == NewArrayBuffer || arguments->op() == PhantomNewArrayBuffer) {
+        return insertionSet.insertConstant(
+            nodeIndex, origin, jsNumber(arguments->castOperand<JSFixedArray*>()->length()));
+    }
     
     InlineCallFrame* inlineCallFrame = arguments->origin.semantic.inlineCallFrame;