Merge r224426 - The Abstract Interpreter needs to change similar to c…

…lobberize() in r224366 https://bugs.webkit.org/show_bug.cgi?id=179267 Reviewed by Saam Barati. Add clobberWorld() to HasGenericProperty, HasStructureProperty & GetPropertyEnumerator cases in the abstract interpreter to match what was done for r224366. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
WebKit · Jan 24, 2018 · bc05fce · bc05fce
1 parent f50f36a
commit bc05fce
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 0 deletions.
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,16 @@
+2017-11-03  Michael Saboff  <msaboff@apple.com>
+
+        The Abstract Interpreter needs to change similar to clobberize() in r224366
+        https://bugs.webkit.org/show_bug.cgi?id=179267
+
+        Reviewed by Saam Barati.
+
+        Add clobberWorld() to HasGenericProperty, HasStructureProperty & GetPropertyEnumerator
+        cases in the abstract interpreter to match what was done for r224366.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
 
         AI does not correctly model the clobber case of ArithClz32

diff --git a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
@@ -2862,10 +2862,12 @@ bool AbstractInterpreter<AbstractStateType>::executeEffects(unsigned clobberLimi
     }
     case HasGenericProperty: {
         forNode(node).setType(SpecBoolean);
+        clobberWorld(node->origin.semantic, clobberLimit);
         break;
     }
     case HasStructureProperty: {
         forNode(node).setType(SpecBoolean);
+        clobberWorld(node->origin.semantic, clobberLimit);
         break;
     }
     case HasIndexedProperty: {
@@ -2892,6 +2894,7 @@ bool AbstractInterpreter<AbstractStateType>::executeEffects(unsigned clobberLimi
     }
     case GetPropertyEnumerator: {
         forNode(node).setType(m_graph, SpecCell);
+        clobberWorld(node->origin.semantic, clobberLimit);
         break;
     }
     case GetEnumeratorStructurePname: {