Imported WebKit commit 356d83016b090995d08ad568f2d2c243aa55e831 (http://svn.webkit.org/repository/webkit/trunk@126147)

New snapshot including various build fixes for newer Qt 5

1 files changed, 18 insertions, 4 deletions

diff --git a/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp b/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp
index e86c57dff..68627f95c 100644
--- a/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp
@@ -82,6 +82,7 @@ public:
                 }
                     
                 case ForwardCheckStructure:
+                case ForwardStructureTransitionWatchpoint:
                     // We currently rely on the fact that we're the only ones who would
                     // insert this node.
                     ASSERT_NOT_REACHED();
@@ -94,6 +95,12 @@ public:
                 case AllocatePropertyStorage:
                 case ReallocatePropertyStorage:
                 case GetPropertyStorage:
+                case GetByVal:
+                case PutByVal:
+                case PutByValAlias:
+                case PutByValSafe:
+                case GetArrayLength:
+                case Phantom:
                     // Don't count these uses.
                     break;
                     
@@ -215,17 +222,22 @@ public:
                     break;
                     
                 case PutByVal:
-                case PutByValAlias: {
+                case PutByValAlias:
+                case PutByValSafe: {
                     Edge child1 = m_graph.varArgChild(node, 0);
                     Edge child2 = m_graph.varArgChild(node, 1);
                     
                     if (!m_graph[child1].prediction() || !m_graph[child2].prediction())
                         break;
-                    if (!m_graph[child2].shouldSpeculateInteger() || !isActionableMutableArraySpeculation(m_graph[child1].prediction())) {
+                    if (!m_graph[child2].shouldSpeculateInteger()
+#if USE(JSVALUE32_64)
+                        || m_graph[child1].shouldSpeculateArguments()
+#endif
+                        ) {
                         clobber(live);
                         break;
                     }
-                    if (node.op() == PutByValAlias)
+                    if (node.op() != PutByValSafe)
                         break;
                     if (m_graph[child1].shouldSpeculateArguments())
                         break;
@@ -291,7 +303,7 @@ public:
             dataLog("Hoisting checks for %s\n", m_graph.nameOfVariableAccessData(it->first));
         }
 #endif // DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-
+        
         // Make changes:
         // 1) If a variable's live range does not span a clobber, then inject structure
         //    checks before the SetLocal.
@@ -348,6 +360,8 @@ public:
                     if (block->variablesAtTail.operand(variable->local()) == nodeIndex)
                         block->variablesAtTail.operand(variable->local()) = getLocalIndex;
                     
+                    m_graph.substituteGetLocal(*block, indexInBlock, variable, getLocalIndex);
+                    
                     changed = true;
                     break;
                 }