From 6668b07fcd51f86be243b9e08e667224e30c0cf8 Mon Sep 17 00:00:00 2001 From: Simon Hausmann Date: Wed, 27 Jun 2012 09:28:46 +0200 Subject: Imported WebKit commit 26cd9bd8ab0471ffe987c9b60368f63dc0f1f31b (http://svn.webkit.org/repository/webkit/trunk@121325) New snapshot with more Windows build fixes --- Source/JavaScriptCore/dfg/DFGAbstractState.cpp | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) (limited to 'Source/JavaScriptCore/dfg/DFGAbstractState.cpp') diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp index 94e96853d..c2d49f7ee 100644 --- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp +++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp @@ -1141,13 +1141,19 @@ bool AbstractState::execute(unsigned indexInBlock) case NewArray: case NewArrayBuffer: node.setCanExit(false); - forNode(nodeIndex).set(m_codeBlock->globalObject()->arrayStructure()); + forNode(nodeIndex).set(m_graph.globalObjectFor(node.codeOrigin)->arrayStructure()); + m_haveStructures = true; + break; + + case NewArrayWithSize: + speculateInt32Unary(node); + forNode(nodeIndex).set(m_graph.globalObjectFor(node.codeOrigin)->arrayStructure()); m_haveStructures = true; break; case NewRegexp: node.setCanExit(false); - forNode(nodeIndex).set(m_codeBlock->globalObject()->regExpStructure()); + forNode(nodeIndex).set(m_graph.globalObjectFor(node.codeOrigin)->regExpStructure()); m_haveStructures = true; break; @@ -1392,7 +1398,7 @@ bool AbstractState::execute(unsigned indexInBlock) case StructureTransitionWatchpoint: { // FIXME: Turn CheckStructure into StructureTransitionWatchpoint when possible! AbstractValue& value = forNode(node.child1()); - ASSERT(isCellSpeculation(value.m_type)); + ASSERT(value.isClear() || isCellSpeculation(value.m_type)); // Value could be clear if we've proven must-exit due to a speculation statically known to be bad. value.filter(node.structure()); node.setCanExit(true); break; -- cgit v1.2.1