1 files changed, 23 insertions, 19 deletions

diff --git a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
index 4532214ee..e9b1e0d8b 100644
--- a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
@@ -284,7 +284,8 @@ private:
                     return index;
                 break;
             case PutByVal:
-            case PutByValAlias: {
+            case PutByValAlias:
+            case PutByValSafe: {
                 if (!m_graph.byValIsPure(node))
                     return NoNode;
                 if (m_graph.varArgChild(node, 0) == child1 && canonicalize(m_graph.varArgChild(node, 1)) == canonicalize(child2))
@@ -337,6 +338,7 @@ private:
             Node& node = m_graph[index];
             switch (node.op()) {
             case CheckStructure:
+            case ForwardCheckStructure:
                 if (node.child1() == child1
                     && structureSet.isSupersetOf(node.structureSet()))
                     return true;
@@ -362,6 +364,7 @@ private:
                 
             case PutByVal:
             case PutByValAlias:
+            case PutByValSafe:
                 if (m_graph.byValIsPure(node)) {
                     // If PutByVal speculates that it's accessing an array with an
                     // integer index, then it's impossible for it to cause a structure
@@ -389,6 +392,7 @@ private:
             Node& node = m_graph[index];
             switch (node.op()) {
             case CheckStructure:
+            case ForwardCheckStructure:
                 if (node.child1() == child1
                     && node.structureSet().containsOnly(structure))
                     return true;
@@ -404,6 +408,7 @@ private:
                 
             case PutByVal:
             case PutByValAlias:
+            case PutByValSafe:
                 if (m_graph.byValIsPure(node)) {
                     // If PutByVal speculates that it's accessing an array with an
                     // integer index, then it's impossible for it to cause a structure
@@ -437,6 +442,7 @@ private:
                 break;
             switch (node.op()) {
             case CheckStructure:
+            case ForwardCheckStructure:
                 return NoNode;
                 
             case PhantomPutStructure:
@@ -507,6 +513,7 @@ private:
                 
             case PutByVal:
             case PutByValAlias:
+            case PutByValSafe:
                 if (m_graph.byValIsPure(node)) {
                     // If PutByVal speculates that it's accessing an array with an
                     // integer index, then it's impossible for it to cause a structure
@@ -551,6 +558,7 @@ private:
             case PutByVal:
             case PutByValAlias:
             case GetByVal:
+            case PutByValSafe:
                 if (m_graph.byValIsPure(node)) {
                     // If PutByVal speculates that it's accessing an array with an
                     // integer index, then it's impossible for it to cause a structure
@@ -603,6 +611,7 @@ private:
                 
             case PutByVal:
             case PutByValAlias:
+            case PutByValSafe:
                 if (m_graph.byValIsPure(node)) {
                     // If PutByVal speculates that it's accessing an array with an
                     // integer index, then it's impossible for it to cause a structure
@@ -643,15 +652,6 @@ private:
                 // change the property storage pointer.
                 break;
                 
-            case PutByValAlias:
-                // PutByValAlias can't change the indexed storage pointer
-                break;
-                
-            case PutByVal:
-                if (isFixedIndexedStorageObjectSpeculation(m_graph[m_graph.varArgChild(node, 0)].prediction()) && m_graph.byValIsPure(node))
-                    break;
-                return NoNode;
-
             default:
                 if (m_graph.clobbersWorld(index))
                     return NoNode;
@@ -673,7 +673,7 @@ private:
         return NoNode;
     }
     
-    NodeIndex getLocalLoadElimination(VirtualRegister local, NodeIndex& relevantLocalOp)
+    NodeIndex getLocalLoadElimination(VirtualRegister local, NodeIndex& relevantLocalOp, bool careAboutClobbering)
     {
         relevantLocalOp = NoNode;
         
@@ -703,7 +703,7 @@ private:
                 break;
                 
             default:
-                if (m_graph.clobbersWorld(index))
+                if (careAboutClobbering && m_graph.clobbersWorld(index))
                     return NoNode;
                 break;
             }
@@ -944,13 +944,15 @@ private:
             
         case GetLocal: {
             VariableAccessData* variableAccessData = node.variableAccessData();
-            if (!variableAccessData->isCaptured())
+            if (m_fixpointState == FixpointNotConverged && !variableAccessData->isCaptured())
                 break;
             NodeIndex relevantLocalOp;
-            NodeIndex possibleReplacement = getLocalLoadElimination(variableAccessData->local(), relevantLocalOp);
-            ASSERT(relevantLocalOp == NoNode
-                   || m_graph[relevantLocalOp].op() == GetLocalUnlinked
-                   || m_graph[relevantLocalOp].variableAccessData() == variableAccessData);
+            NodeIndex possibleReplacement = getLocalLoadElimination(variableAccessData->local(), relevantLocalOp, variableAccessData->isCaptured());
+            if (relevantLocalOp == NoNode)
+                break;
+            if (m_graph[relevantLocalOp].op() != GetLocalUnlinked
+                && m_graph[relevantLocalOp].variableAccessData() != variableAccessData)
+                break;
             NodeIndex phiIndex = node.child1().index();
             if (!setReplacement(possibleReplacement))
                 break;
@@ -980,7 +982,7 @@ private:
             
         case GetLocalUnlinked: {
             NodeIndex relevantLocalOpIgnored;
-            m_changed |= setReplacement(getLocalLoadElimination(node.unlinkedLocal(), relevantLocalOpIgnored));
+            m_changed |= setReplacement(getLocalLoadElimination(node.unlinkedLocal(), relevantLocalOpIgnored, true));
             break;
         }
             
@@ -1093,7 +1095,8 @@ private:
                 setReplacement(getByValLoadElimination(node.child1().index(), node.child2().index()));
             break;
             
-        case PutByVal: {
+        case PutByVal:
+        case PutByValSafe: {
             Edge child1 = m_graph.varArgChild(node, 0);
             Edge child2 = m_graph.varArgChild(node, 1);
             if (isActionableMutableArraySpeculation(m_graph[child1].prediction())
@@ -1108,6 +1111,7 @@ private:
         }
             
         case CheckStructure:
+        case ForwardCheckStructure:
             if (checkStructureLoadElimination(node.structureSet(), node.child1().index()))
                 eliminate();
             break;