Changeset 230078 in webkit for trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp

Timestamp:

Mar 29, 2018, 12:09:01 PM (7 years ago)

Author:

[email protected]

Message:

ArrayMode should not try to get the DFG to think it can convert TypedArrays
​https://bugs.webkit.org/show_bug.cgi?id=184137

Reviewed by Saam Barati.

• dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::fromObserved):

File:

• trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp

@@ -119 +119 @@
 
     default:
+        // If we have seen multiple TypedArray types, or a TypedArray and non-typed array, it doesn't make sense to try to convert the object since you can't convert typed arrays.
+        if (observed & ALL_TYPED_ARRAY_MODES)
+            return ArrayMode(Array::Generic, nonArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+
         if ((observed & asArrayModes(NonArray)) && profile->mayInterceptIndexedAccesses(locker))
             return ArrayMode(Array::SelectUsingPredictions).withSpeculationFromProfile(locker, profile, makeSafe);