Commit 3d94f71e authored by fpizlo@apple.com's avatar fpizlo@apple.com
Browse files

Structure check hoisting phase doesn't know about the side-effecting nature of Arrayify

https://bugs.webkit.org/show_bug.cgi?id=97537

Reviewed by Mark Hahnenberg.

No tests because if we use Arrayify then we also use PutByVal(BlankToXYZ), and the latter is
already known to be side-effecting. So this bug shouldn't have had any symptoms, as far as I
can tell.

* dfg/DFGStructureCheckHoistingPhase.cpp:
(JSC::DFG::StructureCheckHoistingPhase::run):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129553 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent d0316b57
2012-09-25 Filip Pizlo <fpizlo@apple.com>
Structure check hoisting phase doesn't know about the side-effecting nature of Arrayify
https://bugs.webkit.org/show_bug.cgi?id=97537
Reviewed by Mark Hahnenberg.
No tests because if we use Arrayify then we also use PutByVal(BlankToXYZ), and the latter is
already known to be side-effecting. So this bug shouldn't have had any symptoms, as far as I
can tell.
* dfg/DFGStructureCheckHoistingPhase.cpp:
(JSC::DFG::StructureCheckHoistingPhase::run):
2012-09-25 Gavin Barraclough <barraclough@apple.com>
 
Regression: put beyond vector length prefers prototype setters to sparse properties
......
......@@ -315,6 +315,7 @@ public:
case ResolveBase:
case ResolveBaseStrictPut:
case ResolveGlobal:
case Arrayify:
clobber(live);
break;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment