DFG should not speculate array even when predictions say that the base is not an...

[WebKit-https.git] / Source / JavaScriptCore / bytecode / PredictedType.h

diff --git a/Source/JavaScriptCore/bytecode/PredictedType.h b/Source/JavaScriptCore/bytecode/PredictedType.h
index 94da64edac93908805369549c5911a1b3ec5e1db..5835fdb746cefda7cfc3ad4ef69377c39096597c 100644 (file)
--- a/Source/JavaScriptCore/bytecode/PredictedType.h
+++ b/Source/JavaScriptCore/bytecode/PredictedType.h
@@ -151,6 +151,28 @@ inline bool isFloat64ArrayPrediction(PredictedType value)
     return value == PredictFloat64Array;
 }
 
     return value == PredictFloat64Array;
 }
 

+inline bool isActionableMutableArrayPrediction(PredictedType value)
+{
+    return isArrayPrediction(value)
+        || isByteArrayPrediction(value)
+        || isInt8ArrayPrediction(value)
+        || isInt16ArrayPrediction(value)
+        || isInt32ArrayPrediction(value)
+        || isUint8ArrayPrediction(value)
+        || isUint16ArrayPrediction(value)
+        || isUint32ArrayPrediction(value)
+#if CPU(X86) || CPU(X86_64)
+        || isFloat32ArrayPrediction(value)
+#endif
+        || isFloat64ArrayPrediction(value);
+}
+
+inline bool isActionableArrayPrediction(PredictedType value)
+{
+    return isStringPrediction(value)
+        || isActionableMutableArrayPrediction(value);
+}
+

 inline bool isArrayOrOtherPrediction(PredictedType value)
 {
     return !!(value & (PredictArray | PredictOther)) && !(value & ~(PredictArray | PredictOther));
 inline bool isArrayOrOtherPrediction(PredictedType value)
 {
     return !!(value & (PredictArray | PredictOther)) && !(value & ~(PredictArray | PredictOther));