webkitgtk-2.16.5HEADwebkitgtk-2.16.5master

1 files changed, 32 insertions, 14 deletions

diff --git a/Source/JavaScriptCore/dfg/DFGClobberSet.cpp b/Source/JavaScriptCore/dfg/DFGClobberSet.cpp
index 791314172..68e9c05a8 100644
--- a/Source/JavaScriptCore/dfg/DFGClobberSet.cpp
+++ b/Source/JavaScriptCore/dfg/DFGClobberSet.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,7 +29,7 @@
 #if ENABLE(DFG_JIT)
 
 #include "DFGClobberize.h"
-#include "Operations.h"
+#include "JSCInlines.h"
 #include <wtf/ListDump.h>
 
 namespace JSC { namespace DFG {
@@ -81,6 +81,23 @@ bool ClobberSet::overlaps(AbstractHeap heap) const
 {
     if (m_clobbers.find(heap) != m_clobbers.end())
         return true;
+    if (heap.kind() == DOMState && !heap.payload().isTop()) {
+        // DOMState heap has its own hierarchy. For direct heap clobbers that payload is not Top,
+        // we should query whether the clobber overlaps with the given heap.
+        DOMJIT::HeapRange range = DOMJIT::HeapRange::fromRaw(heap.payload().value32());
+        for (auto pair : m_clobbers) {
+            bool direct = pair.value;
+            if (!direct)
+                continue;
+            AbstractHeap clobber = pair.key;
+            if (clobber.kind() != DOMState)
+                continue;
+            if (clobber.payload().isTop())
+                return true;
+            if (DOMJIT::HeapRange::fromRaw(clobber.payload().value32()).overlaps(range))
+                return true;
+        }
+    }
     while (heap.kind() != World) {
         heap = heap.supertype();
         if (contains(heap))
@@ -112,9 +129,9 @@ void ClobberSet::dump(PrintStream& out) const
 HashSet<AbstractHeap> ClobberSet::setOf(bool direct) const
 {
     HashSet<AbstractHeap> result;
-    for (HashMap<AbstractHeap, bool>::const_iterator iter = m_clobbers.begin(); iter != m_clobbers.end(); ++iter) {
-        if (iter->value == direct)
-            result.add(iter->key);
+    for (auto& clobber : m_clobbers) {
+        if (clobber.value == direct)
+            result.add(clobber.key);
     }
     return result;
 }
@@ -122,37 +139,38 @@ HashSet<AbstractHeap> ClobberSet::setOf(bool direct) const
 void addReads(Graph& graph, Node* node, ClobberSet& readSet)
 {
     ClobberSetAdd addRead(readSet);
-    NoOpClobberize addWrite;
-    clobberize(graph, node, addRead, addWrite);
+    NoOpClobberize noOp;
+    clobberize(graph, node, addRead, noOp, noOp);
 }
 
 void addWrites(Graph& graph, Node* node, ClobberSet& writeSet)
 {
-    NoOpClobberize addRead;
+    NoOpClobberize noOp;
     ClobberSetAdd addWrite(writeSet);
-    clobberize(graph, node, addRead, addWrite);
+    clobberize(graph, node, noOp, addWrite, noOp);
 }
 
 void addReadsAndWrites(Graph& graph, Node* node, ClobberSet& readSet, ClobberSet& writeSet)
 {
     ClobberSetAdd addRead(readSet);
     ClobberSetAdd addWrite(writeSet);
-    clobberize(graph, node, addRead, addWrite);
+    NoOpClobberize noOp;
+    clobberize(graph, node, addRead, addWrite, noOp);
 }
 
 bool readsOverlap(Graph& graph, Node* node, ClobberSet& readSet)
 {
     ClobberSetOverlaps addRead(readSet);
-    NoOpClobberize addWrite;
-    clobberize(graph, node, addRead, addWrite);
+    NoOpClobberize noOp;
+    clobberize(graph, node, addRead, noOp, noOp);
     return addRead.result();
 }
 
 bool writesOverlap(Graph& graph, Node* node, ClobberSet& writeSet)
 {
-    NoOpClobberize addRead;
+    NoOpClobberize noOp;
     ClobberSetOverlaps addWrite(writeSet);
-    clobberize(graph, node, addRead, addWrite);
+    clobberize(graph, node, noOp, addWrite, noOp);
     return addWrite.result();
 }