RESOLVED FIXED Bug 69663
DFG ConvertThis speculation logic is wrong 
https://bugs.webkit.org/show_bug.cgi?id=69663
Summary DFG ConvertThis speculation logic is wrong
Filip Pizlo
Reported 2011-10-07 13:31:09 PDT
It tests the prediction of ConvertThis's result, rather than that of its child.
Attachments
the patch (3.56 KB, patch)
2011-10-07 13:32 PDT, Filip Pizlo 		oliver: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2011-10-07 13:32:34 PDT
Created attachment 110207 [details] the patch
Oliver Hunt
Comment 2 2011-10-07 13:37:51 PDT
Comment on attachment 110207 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=110207&action=review > Source/JavaScriptCore/dfg/DFGPropagator.cpp:723 > - printf(" @%u -> %s", nodeIndex, isArray ? "GetArrayLength" : "GetStringLength"); > + printf(" @%u -> %s", m_compileIndex, isArray ? "GetArrayLength" : "GetStringLength"); Whoops, my bad
Filip Pizlo
Comment 3 2011-10-07 13:57:26 PDT
Landed in r96980.
Note You need to log in before you can comment on or make changes to this bug.