Imported WebKit commit 0dc6cd75e1d4836eaffbb520be96fac4847cc9d2 (http://svn.webkit.org/repository/webkit/trunk@131300)

WebKit update which introduces the QtWebKitWidgets module that contains the WK1
widgets based API. (In fact it renames QtWebKit to QtWebKitWidgets while we're
working on completing the entire split as part of
https://bugs.webkit.org/show_bug.cgi?id=99314

1 files changed, 2 insertions, 6 deletions

diff --git a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
index cea2f3c48..1b08bc6b0 100644
--- a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
@@ -177,6 +177,7 @@ private:
                 if (!m_graph.byValIsPure(node))
                     return NoNode;
                 switch (node.arrayMode()) {
+                case CONTIGUOUS_TO_TAIL_MODES:
                 case ARRAY_STORAGE_TO_HOLE_MODES:
                     return NoNode;
                 default:
@@ -359,9 +360,6 @@ private:
                 // for a structure change or a put to property storage to affect
                 // the GetByVal.
                 break;
-            case ArrayPush:
-                // A push cannot affect previously existing elements in the array.
-                break;
             default:
                 if (m_graph.clobbersWorld(index))
                     return NoNode;
@@ -1222,9 +1220,7 @@ private:
         case PutByVal: {
             Edge child1 = m_graph.varArgChild(node, 0);
             Edge child2 = m_graph.varArgChild(node, 1);
-            if (isActionableMutableArraySpeculation(m_graph[child1].prediction())
-                && m_graph[child2].shouldSpeculateInteger()
-                && !m_graph[child1].shouldSpeculateArguments()) {
+            if (canCSEStorage(node.arrayMode())) {
                 NodeIndex nodeIndex = getByValLoadElimination(child1.index(), child2.index());
                 if (nodeIndex == NoNode)
                     break;