Bug 69663

Summary:

DFG ConvertThis speculation logic is wrong

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

JavaScriptCore

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Attachments:

Description	Flags
the patch	oliver: review+

Description Filip Pizlo 2011-10-07 13:31:09 PDT

It tests the prediction of ConvertThis's result, rather than that of its child.

Comment 1 Filip Pizlo 2011-10-07 13:32:34 PDT

Created attachment 110207 [details]
the patch

Comment 2 Oliver Hunt 2011-10-07 13:37:51 PDT

Comment on attachment 110207 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=110207&action=review

> Source/JavaScriptCore/dfg/DFGPropagator.cpp:723
> -            printf("  @%u -> %s", nodeIndex, isArray ? "GetArrayLength" : "GetStringLength");
> +            printf("  @%u -> %s", m_compileIndex, isArray ? "GetArrayLength" : "GetStringLength");

Whoops, my bad

Comment 3 Filip Pizlo 2011-10-07 13:57:26 PDT

Landed in r96980.