[Webkit-unassigned] [Bug 69716] DFG should not always speculate that a ByVal access has an integer index
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Sun Oct 9 10:13:57 PDT 2011
https://bugs.webkit.org/show_bug.cgi?id=69716
Oliver Hunt <oliver at apple.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #110295|review? |review+
Flag| |
--- Comment #8 from Oliver Hunt <oliver at apple.com> 2011-10-09 10:13:57 PST ---
(From update of attachment 110295)
View in context: https://bugs.webkit.org/attachment.cgi?id=110295&action=review
r=me, but update those comments
> Source/JavaScriptCore/dfg/DFGPropagator.cpp:1025
> + // PutByVal currently always speculates that it's accessing an array with an
> + // integer index, which means that it's impossible for it to cause a structure
> + // change.
This comment should be updated to indicate this only applies when integer properties are being accessed
> Source/JavaScriptCore/dfg/DFGPropagator.cpp:1093
> + // PutByVal currently always speculates that it's accessing an array with an
> + // integer index, which means that it's impossible for it to cause a structure
> + // change.
as above
> Source/JavaScriptCore/dfg/DFGPropagator.cpp:1136
> + // PutByVal currently always speculates that it's accessing an array with an
> + // integer index, which means that it's impossible for it to cause a structure
> + // change.
ditto
> Source/JavaScriptCore/dfg/DFGPropagator.cpp:1172
> + // PutByVal currently always speculates that it's accessing an array with an
> + // integer index, which means that it's impossible for it to cause a structure
> + // change.
ditto
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list