Bug 174110 – DFGBytecodeParser op_to_this does not access the correct instruction offset for to this status

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Saam Barati]

This is the code:
```
        case op_to_this: {
            Node* op1 = getThis();
            if (op1->op() != ToThis) {
                Structure* cachedStructure = currentInstruction[2].u.structure.get();
                if (currentInstruction[2].u.toThisStatus != ToThisOK
                    || !cachedStructure
                    || cachedStructure->classInfo()->methodTable.toThis != JSObject::info()->methodTable.toThis
                    || m_inlineStackTop->m_profiledBlock->couldTakeSlowCase(m_currentIndex)
                    || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache)
                    || (op1->op() == GetLocal && op1->variableAccessData()->structureCheckHoistingFailed())) {
                    setThis(addToGraph(ToThis, op1));
                } else {
                    addToGraph(
                        CheckStructure,
                        OpInfo(m_graph.addStructureSet(cachedStructure)),
                        op1);
                }
            }
            NEXT_OPCODE(op_to_this);
        }
```

it can't be the case that the toThisStatus and the structure are at the same offset.

[Saam Barati]

Created attachment 314539 [details]
patch

[Michael Saboff]

Comment on attachment 314539 [details]
patch

Wow.  r=me

[WebKit Commit Bot]

Comment on attachment 314539 [details]
patch

Clearing flags on attachment: 314539

Committed r219111: <http://trac.webkit.org/changeset/219111>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.