Changeset 283096 in webkit for trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

Timestamp:

Sep 26, 2021, 9:25:46 PM (4 years ago)

Author:

[email protected]

Message:

Unreviewed, reverting r283095.
​https://bugs.webkit.org/show_bug.cgi?id=230815

We should land the original patch since this does not work
with bytecode cache

Reverted changeset:

"[JSC] Optimize PutByVal with for-in"
​https://bugs.webkit.org/show_bug.cgi?id=230801
​https://commits.webkit.org/r283095

File:

• trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -4228 +4228 @@
         // FIXME: We should have a way to see if anyone is actually using the propertyName for something other than a get_by_val. If not, we could eliminate the toString in this opcode.
         generator.emitEnumeratorNext(propertyName.get(), mode.get(), index.get(), base.get(), enumerator.get());
-        generator.emitJumpIfSentinelString(propertyName.get(), scope->breakTarget());
+
+        // Note, choosing undefined or null helps please DFG's Abstract Interpreter as it doesn't distinguish null and undefined as types (via SpecOther).
+        generator.emitJumpIfTrue(generator.emitIsUndefinedOrNull(generator.newTemporary(), propertyName.get()), scope->breakTarget());
 
         this->emitLoopHeader(generator, propertyName.get());