Commit 628ff3fb authored by oliver@apple.com's avatar oliver@apple.com

fourthTier: SpeculativeJIT::checkArray should use the correct ExitKind

https://bugs.webkit.org/show_bug.cgi?id=115943

Currently it uses Uncountable, which gives us no information if we end up exiting due to a
mismatched ClassInfo pointer. It should instead use BadType and should pass the correct
JSValueSource and Node instead of passing empty values.

Reviewed by Filip Pizlo.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::checkArray):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153157 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 0d018be1
2013-05-10 Mark Hahnenberg <mhahnenberg@apple.com>
SpeculativeJIT::checkArray should use the correct ExitKind
https://bugs.webkit.org/show_bug.cgi?id=115943
Currently it uses Uncountable, which gives us no information if we end up exiting due to a
mismatched ClassInfo pointer. It should instead use BadType and should pass the correct
JSValueSource and Node instead of passing empty values.
Reviewed by Filip Pizlo.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::checkArray):
2013-05-11 Filip Pizlo <fpizlo@apple.com>
fourthTier: FTL should support Jump and ForceOSRExit
......@@ -31,6 +45,7 @@
* runtime/Options.h:
(JSC):
>>>>>>> .r149942
2013-05-10 Filip Pizlo <fpizlo@apple.com>
fourthTier: FTL should support CompareStrictEqConstant
......
......@@ -744,7 +744,7 @@ void SpeculativeJIT::checkArray(Node* node)
m_jit.loadPtr(
MacroAssembler::Address(baseReg, JSCell::structureOffset()), temp.gpr());
speculationCheck(
Uncountable, JSValueRegs(), 0,
BadType, JSValueRegs(baseReg), node,
m_jit.branchPtr(
MacroAssembler::NotEqual,
MacroAssembler::Address(temp.gpr(), Structure::classInfoOffset()),
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment