WebKit Bugzilla
New
Browse
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
RESOLVED FIXED
104500
DFG ArrayPush/Pop should not pass their second child as the index for blessArrayOperation()
https://bugs.webkit.org/show_bug.cgi?id=104500
Summary
DFG ArrayPush/Pop should not pass their second child as the index for blessAr...
Filip Pizlo
Reported
2012-12-09 17:05:47 PST
blessArrayOperation() takes an index, which if present, indicates that the DFG should perform additional checks (on the index) when triggering array conversions. This is applicable to things like: array[100000000] = 5; Where we wouldn't want to convert to a contiguous array kind, since that would be kind of not good. But the second child of ArrayPush/Pop is not an index. For ArrayPush, it's the value being pushed. For ArrayPop, it's the storage pointer. So, if we have an ArrayPush or ArrayPop that triggers array conversion (which is admittedly rare) then we'll currently end up doing really strange things. This ought not result in incorrect execution, but likely will execute in bad performance. The Arrayify nodes are already robust against their index child being empty. So we should just pass Edge() (i.e. the non-existant edge) as the index for blessArrayOperation() on ArrayPush/Pop.
Attachments
the patch
(2.36 KB, patch)
2012-12-09 17:07 PST
,
Filip Pizlo
oliver
: review+
Details
Formatted Diff
Diff
View All
Add attachment
proposed patch, testcase, etc.
Filip Pizlo
Comment 1
2012-12-09 17:07:20 PST
Created
attachment 178456
[details]
the patch
Filip Pizlo
Comment 2
2012-12-09 22:56:10 PST
Landed in
http://trac.webkit.org/changeset/137110
Note
You need to
log in
before you can comment on or make changes to this bug.
Top of Page
Format For Printing
XML
Clone This Bug