Imported WebKit commit 20271caf2e2c016d5cef40184cddeefeac4f1876 (http://svn.webkit.org/repository/webkit/trunk@133733)

New snapshot that contains all previous fixes as well as build fix for latest QtMultimedia API changes.

1 files changed, 15 insertions, 3 deletions

diff --git a/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp b/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
index 25915cfd4..43aa2c007 100644
--- a/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
@@ -92,10 +92,22 @@ private:
             }
                     
             case CheckStructure:
-            case ForwardCheckStructure: {
+            case ForwardCheckStructure:
+            case ArrayifyToStructure: {
                 AbstractValue& value = m_state.forNode(node.child1());
+                StructureSet set;
+                if (node.op() == ArrayifyToStructure)
+                    set = node.structure();
+                else
+                    set = node.structureSet();
+                if (value.m_currentKnownStructure.isSubsetOf(set)) {
+                    ASSERT(node.refCount() == 1);
+                    node.setOpAndDefaultFlags(Phantom);
+                    eliminated = true;
+                    break;
+                }
                 StructureAbstractValue& structureValue = value.m_futurePossibleStructure;
-                if (structureValue.isSubsetOf(node.structureSet())
+                if (structureValue.isSubsetOf(set)
                     && structureValue.hasSingleton()
                     && isCellSpeculation(value.m_type))
                     node.convertToStructureTransitionWatchpoint(structureValue.singleton());
@@ -104,7 +116,7 @@ private:
                 
             case CheckArray:
             case Arrayify: {
-                if (!modeAlreadyChecked(m_state.forNode(node.child1()), node.arrayMode()))
+                if (!node.arrayMode().alreadyChecked(m_state.forNode(node.child1())))
                     break;
                 ASSERT(node.refCount() == 1);
                 node.setOpAndDefaultFlags(Phantom);