Remove an invalid assertion in the DFG backend's GetById emitter.
authormark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 17 Aug 2016 21:00:45 +0000 (21:00 +0000)
committermark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 17 Aug 2016 21:00:45 +0000 (21:00 +0000)
commit93f549ee3eb3717eed90eaa3d04004c0adc96c2d
tree62de4d81e47d464da4ba90ab7a76b52eee058eff
parente78414b22f9c0ec7307a7475f91101f6f5f6724e
Remove an invalid assertion in the DFG backend's GetById emitter.
https://bugs.webkit.org/show_bug.cgi?id=160925
<rdar://problem/27248961>

Reviewed by Filip Pizlo.

JSTests:

* stress/dfg-get-by-id-should-not-assert-non-null-prediction.js: Added.

Source/JavaScriptCore:

The DFG backend's GetById assertion that the node's prediction not be SpecNone
is just plain wrong.  It assumes that we can never have a GetById node without a
type prediction, but this is not true.  The following test case proves otherwise:

    function foo() {
        "use strict";
        return --arguments["callee"];
    }

Will remove the assertion.  Nothing else needs to change as the DFG is working
correctly without the assertion.

* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@204570 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/stress/dfg-get-by-id-should-not-assert-non-null-prediction.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp