From 815f1ed417bd26fbe2abbdf20ac5d3423b30796c Mon Sep 17 00:00:00 2001 From: Simon Hausmann Date: Mon, 23 Jul 2012 09:28:44 +0200 Subject: Imported WebKit commit e65cbc5b6ac32627c797e7fc7f46eb7794410c92 (http://svn.webkit.org/repository/webkit/trunk@123308) New snapshot with better configure tests --- Source/JavaScriptCore/dfg/DFGAbstractState.cpp | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'Source/JavaScriptCore/dfg/DFGAbstractState.cpp') diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp index e4561da06..01996f132 100644 --- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp +++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp @@ -128,6 +128,8 @@ void AbstractState::initialize(Graph& graph) root->valuesAtHead.argument(i).set(SpecFloat32Array); else if (isFloat64ArraySpeculation(prediction)) root->valuesAtHead.argument(i).set(SpecFloat64Array); + else if (isCellSpeculation(prediction)) + root->valuesAtHead.argument(i).set(SpecCell); else root->valuesAtHead.argument(i).makeTop(); @@ -272,7 +274,8 @@ bool AbstractState::execute(unsigned indexInBlock) } case SetLocal: { - if (node.variableAccessData()->isCaptured()) { + if (node.variableAccessData()->isCaptured() + || m_graph.isCreatedThisArgument(node.local())) { m_variables.operand(node.local()) = forNode(node.child1()); node.setCanExit(false); break; @@ -290,6 +293,9 @@ bool AbstractState::execute(unsigned indexInBlock) else if (isArraySpeculation(predictedType)) { node.setCanExit(!isArraySpeculation(forNode(node.child1()).m_type)); forNode(node.child1()).filter(SpecArray); + } else if (isCellSpeculation(predictedType)) { + node.setCanExit(!isCellSpeculation(forNode(node.child1()).m_type)); + forNode(node.child1()).filter(SpecCell); } else if (isBooleanSpeculation(predictedType)) speculateBooleanUnary(node); else @@ -1437,6 +1443,8 @@ bool AbstractState::execute(unsigned indexInBlock) m_haveStructures = true; break; case GetPropertyStorage: + case AllocatePropertyStorage: + case ReallocatePropertyStorage: node.setCanExit(false); forNode(node.child1()).filter(SpecCell); forNode(nodeIndex).clear(); // The result is not a JS value. -- cgit v1.2.1