diff options
Diffstat (limited to 'Source/JavaScriptCore/dfg/DFGAbstractState.cpp')
| -rw-r--r-- | Source/JavaScriptCore/dfg/DFGAbstractState.cpp | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp index e4561da06..01996f132 100644 --- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp +++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp @@ -128,6 +128,8 @@ void AbstractState::initialize(Graph& graph) root->valuesAtHead.argument(i).set(SpecFloat32Array); else if (isFloat64ArraySpeculation(prediction)) root->valuesAtHead.argument(i).set(SpecFloat64Array); + else if (isCellSpeculation(prediction)) + root->valuesAtHead.argument(i).set(SpecCell); else root->valuesAtHead.argument(i).makeTop(); @@ -272,7 +274,8 @@ bool AbstractState::execute(unsigned indexInBlock) } case SetLocal: { - if (node.variableAccessData()->isCaptured()) { + if (node.variableAccessData()->isCaptured() + || m_graph.isCreatedThisArgument(node.local())) { m_variables.operand(node.local()) = forNode(node.child1()); node.setCanExit(false); break; @@ -290,6 +293,9 @@ bool AbstractState::execute(unsigned indexInBlock) else if (isArraySpeculation(predictedType)) { node.setCanExit(!isArraySpeculation(forNode(node.child1()).m_type)); forNode(node.child1()).filter(SpecArray); + } else if (isCellSpeculation(predictedType)) { + node.setCanExit(!isCellSpeculation(forNode(node.child1()).m_type)); + forNode(node.child1()).filter(SpecCell); } else if (isBooleanSpeculation(predictedType)) speculateBooleanUnary(node); else @@ -1437,6 +1443,8 @@ bool AbstractState::execute(unsigned indexInBlock) m_haveStructures = true; break; case GetPropertyStorage: + case AllocatePropertyStorage: + case ReallocatePropertyStorage: node.setCanExit(false); forNode(node.child1()).filter(SpecCell); forNode(nodeIndex).clear(); // The result is not a JS value. |