RESOLVED FIXED 104500
DFG ArrayPush/Pop should not pass their second child as the index for blessArrayOperation()
https://bugs.webkit.org/show_bug.cgi?id=104500
Summary DFG ArrayPush/Pop should not pass their second child as the index for blessAr...
Filip Pizlo
Reported 2012-12-09 17:05:47 PST
blessArrayOperation() takes an index, which if present, indicates that the DFG should perform additional checks (on the index) when triggering array conversions. This is applicable to things like: array[100000000] = 5; Where we wouldn't want to convert to a contiguous array kind, since that would be kind of not good. But the second child of ArrayPush/Pop is not an index. For ArrayPush, it's the value being pushed. For ArrayPop, it's the storage pointer. So, if we have an ArrayPush or ArrayPop that triggers array conversion (which is admittedly rare) then we'll currently end up doing really strange things. This ought not result in incorrect execution, but likely will execute in bad performance. The Arrayify nodes are already robust against their index child being empty. So we should just pass Edge() (i.e. the non-existant edge) as the index for blessArrayOperation() on ArrayPush/Pop.
Attachments
the patch (2.36 KB, patch)
2012-12-09 17:07 PST, Filip Pizlo
oliver: review+
Filip Pizlo
Comment 1 2012-12-09 17:07:20 PST
Created attachment 178456 [details] the patch
Filip Pizlo
Comment 2 2012-12-09 22:56:10 PST
Note You need to log in before you can comment on or make changes to this bug.