REGRESSION(r154218): DFG::FixupPhase no longer turns GetById's child1 into CellUse
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 19 Aug 2013 04:46:41 +0000 (04:46 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 19 Aug 2013 04:46:41 +0000 (04:46 +0000)
https://bugs.webkit.org/show_bug.cgi?id=119961

Reviewed by Mark Hahnenberg.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@154261 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

index 47fbbe0..96901cc 100644 (file)
@@ -1,3 +1,13 @@
+2013-08-17  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r154218): DFG::FixupPhase no longer turns GetById's child1 into CellUse
+        https://bugs.webkit.org/show_bug.cgi?id=119961
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
 2013-08-18  Gavin Barraclough  <barraclough@apple.com>
 
         https://bugs.webkit.org/show_bug.cgi?id=119972
index 5e07318..0c20704 100644 (file)
@@ -737,6 +737,7 @@ private:
                 attemptToMakeGetByteLength(node);
                 break;
             }
+            setUseKindAndUnboxIfProfitable<CellUse>(node->child1());
             break;
         }