DFG should know that CreateThis can be effectful
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 26 Mar 2018 21:01:16 +0000 (21:01 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 26 Mar 2018 21:01:16 +0000 (21:01 +0000)
commitec71f2f2245a2e1f8baf29b4ee93022ad4da812e
tree132c40e6c217563f7d4f3d6f42bee18f5865fac4
parent7698d4474dba1b560af25588e268746f8f0cda86
DFG should know that CreateThis can be effectful
https://bugs.webkit.org/show_bug.cgi?id=184013

Reviewed by Saam Barati.

JSTests:

* stress/create-this-property-change.js: Added.
(Foo):
(RealBar):
(get if):
* stress/create-this-structure-change-without-cse.js: Added.
(Foo):
(RealBar):
(get if):
* stress/create-this-structure-change.js: Added.
(Foo):
(RealBar):
(get if):

Source/JavaScriptCore:

As shown in the tests added in JSTests, CreateThis can be effectful if the constructor this
is a proxy.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229987 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/stress/create-this-property-change.js [new file with mode: 0644]
JSTests/stress/create-this-structure-change-without-cse.js [new file with mode: 0644]
JSTests/stress/create-this-structure-change.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
Source/JavaScriptCore/dfg/DFGClobberize.h