Bug 69663

Summary: DFG ConvertThis speculation logic is wrong
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal    
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
the patch oliver: review+

Filip Pizlo
Reported 2011-10-07 13:31:09 PDT
It tests the prediction of ConvertThis's result, rather than that of its child.
Attachments
the patch (3.56 KB, patch)
2011-10-07 13:32 PDT, Filip Pizlo 		oliver: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2011-10-07 13:32:34 PDT
Created attachment 110207 [details] the patch
Oliver Hunt
Comment 2 2011-10-07 13:37:51 PDT
Comment on attachment 110207 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=110207&action=review > Source/JavaScriptCore/dfg/DFGPropagator.cpp:723 > - printf(" @%u -> %s", nodeIndex, isArray ? "GetArrayLength" : "GetStringLength"); > + printf(" @%u -> %s", m_compileIndex, isArray ? "GetArrayLength" : "GetStringLength"); Whoops, my bad
Filip Pizlo
Comment 3 2011-10-07 13:57:26 PDT
Landed in r96980.
Note You need to log in before you can comment on or make changes to this bug.