Imported WebKit commit e65cbc5b6ac32627c797e7fc7f46eb7794410c92 (http://svn.webkit.org/repository/webkit/trunk@123308)

New snapshot with better configure tests

1 files changed, 13 insertions, 0 deletions

diff --git a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
index 04c3ebc66..4532214ee 100644
--- a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
@@ -465,6 +465,8 @@ private:
             case NewArray:
             case NewObject:
             case CreateThis:
+            case AllocatePropertyStorage:
+            case ReallocatePropertyStorage:
                 return NoNode;
                 
             default:
@@ -581,6 +583,17 @@ private:
                 if (node.child1() == child1)
                     return index;
                 break;
+
+            case AllocatePropertyStorage:
+            case ReallocatePropertyStorage:
+                // If we can cheaply prove this is a change to our object's storage, we
+                // can optimize and use its result.
+                if (node.child1() == child1)
+                    return index;
+                // Otherwise, we currently can't prove that this doesn't change our object's
+                // storage, so we conservatively assume that it may change the storage
+                // pointer of any object, including ours.
+                return NoNode;
                 
             case PutByOffset:
             case PutStructure: