Bug 69663 - DFG ConvertThis speculation logic is wrong
Summary: DFG ConvertThis speculation logic is wrong
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-10-07 13:31 PDT by Filip Pizlo
Modified: 2011-10-07 13:57 PDT (History)
0 users

See Also:

Attachments
the patch (3.56 KB, patch)
2011-10-07 13:32 PDT, Filip Pizlo 		oliver: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2011-10-07 13:31:09 PDT 
It tests the prediction of ConvertThis's result, rather than that of its child.
Comment 1 Filip Pizlo 2011-10-07 13:32:34 PDT 
Created attachment 110207 [details]
the patch
Comment 2 Oliver Hunt 2011-10-07 13:37:51 PDT 
Comment on attachment 110207 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=110207&action=review

> Source/JavaScriptCore/dfg/DFGPropagator.cpp:723
> -            printf("  @%u -> %s", nodeIndex, isArray ? "GetArrayLength" : "GetStringLength");
> +            printf("  @%u -> %s", m_compileIndex, isArray ? "GetArrayLength" : "GetStringLength");

Whoops, my bad
Comment 3 Filip Pizlo 2011-10-07 13:57:26 PDT 
Landed in r96980.