RESOLVED FIXED 140389
DFG can call PutByValDirect for generic arrays 
https://bugs.webkit.org/show_bug.cgi?id=140389
Summary DFG can call PutByValDirect for generic arrays
Yusuke Suzuki
Reported 2015-01-13 05:48:52 PST
DFG can call PutByValDirect for generic arrays
Attachments
Patch (6.05 KB, patch)
2015-01-13 05:55 PST, Yusuke Suzuki 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Yusuke Suzuki
Comment 1 2015-01-13 05:55:19 PST
Created attachment 244509 [details] Patch
Yusuke Suzuki
Comment 2 2015-01-13 05:57:38 PST
Comment on attachment 244509 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=244509&action=review Added comments. > Source/JavaScriptCore/dfg/DFGOperations.cpp:-129 > - asObject(baseValue)->putDirect(*vm, jsCast<NameInstance*>(property.asCell())->privateName(), value, slot); Seeing the code, reaching here, property is guaranteed that it's not NameInstance. > Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:2566 > + DFG_ASSERT(m_jit.graph(), node, node->op() == PutByVal || node->op() == PutByValDirect); PutByValDirect can use this path for computed properties in object initializers (ES6).
Geoffrey Garen
Comment 3 2015-01-13 11:36:03 PST
Comment on attachment 244509 [details] Patch r=me
WebKit Commit Bot
Comment 4 2015-01-13 12:18:09 PST
Comment on attachment 244509 [details] Patch Clearing flags on attachment: 244509 Committed r178370: <http://trac.webkit.org/changeset/178370>
WebKit Commit Bot
Comment 5 2015-01-13 12:18:12 PST
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.